diff --git a/runtime/history/NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-TOPOLOGY-RCA42.json b/runtime/history/NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-TOPOLOGY-RCA42.json
new file mode 100644
index 00000000..2568b9d3
--- /dev/null
+++ b/runtime/history/NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-TOPOLOGY-RCA42.json
@@ -0,0 +1,38 @@
+{
+  "schema_version": 1,
+  "channel": "homelab-runtime",
+  "command_id": "NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-TOPOLOGY-RCA42",
+  "status": "OK",
+  "rc": 0,
+  "host": "pve01",
+  "mode": "read-only",
+  "component": "newfi-stagingedge-public-ingress-topology-rca-v6",
+  "started_at_utc": "2026-09-08T18:19:52Z",
+  "finished_at_utc": "2026-09-08T18:19:52Z",
+  "reference_register_checked": true,
+  "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
+  "error_register_checked": true,
+  "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
+  "command_sha256": "8c1deae24d2c2e50bd7eca16ab18b10c78eb623b43884a033be8abcb060328de",
+  "duplicate_failed_command_blocked": false,
+  "block_reason": null,
+  "execution_started": true,
+  "change_declared": false,
+  "result_contract_valid": true,
+  "result_contract_status": null,
+  "result_contract_error": null,
+  "command_rc": 0,
+  "changes_made": false,
+  "rollback_started": false,
+  "rollback_restored": null,
+  "mutation_outcome": "NO_MUTATION",
+  "sanitized": true,
+  "secrets_included": false,
+  "private_addresses_included": false,
+  "raw_evidence_retained_locally": true,
+  "raw_evidence_sha256": "475297be47aae03d0ef913ed8d3c90d3f0eabe4b0a86b02e6cccd5e805171e4f",
+  "sanitized_output_sha256": "2740dbcc0eb7d919991be01db110d70f85f1c7ab59bcebf520b56960fa9399f9",
+  "output_truncated_in_json": false,
+  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
+  "output": "ERROR_REGISTER_CHECK=OK\nREFERENCE_CHECK=OK\nAUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED\nNEWFI42_RUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\nNEWFI42_KNOWN_HOSTS_SHA256_BEFORE=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735\nNEWFI42_TRUST_FILE_PRESENT=true\nNEWFI42_TRUST_FILE_SHA256=5ff80132df401240519f48091ed62c139183c325000ef7dd253e7f676a539b2c\nNEWFI42_TRUST_EDGEVM_MARKER=true\nNEWFI42_TRUST_REJECTED_MARKER=false\nNEWFI42_ERROR_RELEVANT_LINE_COUNT=50\nNEWFI42_ERROR_RELEVANT_LINES=[{\"line\":19,\"text\":\"CHECK-8: для edge-vm использовать debian@[PRIVATE_IP] и sudo.\"},{\"line\":28,\"text\":\"VM130 edge-vm has secondary disk backup=0 risk.\"},{\"line\":52,\"text\":\"edge-vm: ssh debian@[PRIVATE_IP], внутри использовать sudo.\"},{\"line\":170,\"text\":\"41. Ошибка: post-backup-pass-slo-reconciliation checked pve01 router health on edge-vm.\"},{\"line\":171,\"text\":\"Факт: first reconciliation wrote STATUS=ERROR because router-running-config-mail-cloud.txt is on pve01, not edge-vm.\"},{\"line\":172,\"text\":\"Fix: build reconciliation from pve01 and edge-vm health files by correct owner.\"},{\"line\":213,\"text\":\"## ROUTER_CLI_STDIN_APPLY_FAILURE_20260630\"},{\"line\":214,\"text\":\"- Context: attempted Netcraze router ACL apply through SSH stdin/multiline for Homepage Moscow Router monitor fix.\"},{\"line\":215,\"text\":\"- Evidence: [LONG_REDACTED].txt.\"},{\"line\":219,\"text\":\"## [LONG_REDACTED]\"},{\"line\":221,\"text\":\"- Evidence: [LONG_REDACTED].txt showed COMMAND_COUNT=1.\"},{\"line\":224,\"text\":\"## [LONG_REDACTED]\"},{\"line\":225,\"text\":\"- Context: routerbackup user can run show running-config but cannot execute configuration commands such as access-list.\"},{\"line\":226,\"text\":\"- Evidence: [LONG_REDACTED].txt.\"},{\"line\":228,\"text\":\"- Rule: do not attempt ACL/config changes as routerbackup; use admin/operator router access or router Web UI for write changes.\"},{\"line\":232,\"text\":\"- Evidence: [LONG_REDACTED].txt has blank [LONG_REDACTED] fields.\"},{\"line\":235,\"text\":\"## [LONG_REDACTED]\"},{\"line\":236,\"text\":\"- Context: while moving Moscow Router monitor rules to _WEBADMIN_Bridge1, two _WEBADMIN_Bridge0 Nextcloud Talk TURN rules were accidentally removed.\"},{\"line\":238,\"text\":\"- Verification proof: 399_ROUTER_ACL_RESTORE_AFTER_UI_PROOF.txt.\"},{\"line\":239,\"text\":\"- Rule: after manual router Web UI ACL edits, compare _WEBADMIN_Bridge0, _WEBADMIN_Bridge1 and _WEBADMIN_GigabitEthernet1 before continuing.\"},{\"line\":241,\"text\":\"## [LONG_REDACTED]\"},{\"line\":242,\"text\":\"- Context: proof 400 tested Moscow router HTTPS monitor from Homepage container with custom Node lookup callback.\"},{\"line\":247,\"text\":\"## [LONG_REDACTED]\"},{\"line\":248,\"text\":\"- Context: Moscow Router Homepage monitor after ACL fix.\"},{\"line\":250,\"text\":\"- Observed: edge-vm TCP to [PRIVATE_IP]:5080/5083 is OK, but router HTTP/HTTPS returns 403 for all tested paths.\"},{\"line\":251,\"text\":\"- Impact: Homepage siteMonitor cannot be made green via direct router HTTP URL until router web service allows the Bridge1/Proxmox/protected segment or an explicit safe monitor endpoint is used.\"},{\"line\":255,\"text\":\"- Context: installing edge-vm Moscow router health endpoint.\"},{\"line\":261,\"text\":\"## [LONG_REDACTED]\"},{\"line\":262,\"text\":\"- Context: Moscow Router Homepage siteMonitor attempt using http://[PRIVATE_IP]:5080.\"},{\"line\":264,\"text\":\"- Impact: do not use [PRIVATE_IP] directly as Homepage siteMonitor from edge-vm.\"},{\"line\":265,\"text\":\"- Mitigation: use dedicated edge-vm health endpoint that checks router TCP [PRIVATE_IP]:5080 and returns HTTP 200/503 for Homepage.\"},{\"line\":267,\"text\":\"## [LONG_REDACTED]\"},{\"line\":268,\"text\":\"- Context: applying Moscow Router Homepage siteMonitor health endpoint.\"},{\"line\":273,\"text\":\"## [LONG_REDACTED]\"},{\"line\":274,\"text\":\"- Context: applying Moscow Router Homepage health endpoint.\"},{\"line\":276,\"text\":\"- Evidence: proof 408 showed SyntaxError in /tmp/homepage-router-moscow-apply-fixed.py.\"},{\"line\":582,\"text\":\"- Context: pvepro.ru root/www currently point to the Mailcow VPS and return Mailcow with TLS hostname mismatch.\"},{\"line\":583,\"text\":\"- Decision: because pve01 has no SSH key access to the external VPS, do not modify the VPS. Instead move only pvepro.ru and www.pvepro.ru A records to edge and serve an edge landing page.\"},{\"line\":598,\"text\":\"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router.\"},{\"line\":599,\"text\":\"- Current limitation: there is no safe private remote access path to the dacha router yet.\"},{\"line\":600,\"text\":\"- Rule: do not expose router admin publicly and do not attempt certificate deployment to the router over the public internet.\"},{\"line\":604,\"text\":\"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router.\"},{\"line\":605,\"text\":\"- Current limitation: there is no safe private remote access path to the dacha router yet.\"},{\"line\":606,\"text\":\"- Rule: do not expose router admin publicly and do not attempt certificate deployment to the router over the public internet.\"},{\"line\":610,\"text\":\"- Context: configuring private management path for taftauto.ru dacha router.\"},{\"line\":612,\"text\":\"- Rule: generated client config may be stored only as root/debian mode 600 file and must be imported into the Netcraze router UI manually.\"},{\"line\":613,\"text\":\"- Rule: do not open router public admin or certificate deployment until WireGuard handshake is proven.\"},{\"line\":626,\"text\":\"- Fix: rebuild SmartApe under External Homelabs with 2-space item indentation, remove Router Moscow, rebuild Sites category.\"},{\"line\":647,\"text\":\"## [LONG_REDACTED]\"},{\"line\":648,\"text\":\"- Previous apply looked for Russian Router card name, but active Homepage Useful group contains Router and Public Domain.\"}]\nNEWFI42_REFERENCE_RELEVANT_LINE_COUNT=50\nNEWFI42_REFERENCE_RELEVANT_LINES=[{\"line\":14,\"text\":\"- VM130 edge-vm | pve03 | running | KEEP\"},{\"line\":75,\"text\":\"NOTE edge-vm disk scsi1 backup=0 risk must be documented\"},{\"line\":90,\"text\":\"HEALTH_NOT_OK item=ingress-dns-route-slo.txt line=STATUS=WARN\"},{\"line\":149,\"text\":\"- У VM130 edge-vm есть риск: дополнительный диск backup=0.\"},{\"line\":166,\"text\":\"- VM130 edge-vm pve03 [PRIVATE_IP] Docker ingress/app host.\"},{\"line\":199,\"text\":\"## ROUTER_NETCRAZE_ULTRA_NC1812_20260630\"},{\"line\":234,\"text\":\"- WAN DHCP observed in router log: 95.84.154.183/23, gateway 95.84.154.1.\"},{\"line\":235,\"text\":\"- ISP DNS observed in router log: 77.37.251.33, 77.37.255.30.\"},{\"line\":282,\"text\":\"- Default router: [PRIVATE_IP].\"},{\"line\":312,\"text\":\"- [PRIVATE_IP] -> bc:24:11:e1:f3:3c NPMplus / edge-vm.\"},{\"line\":315,\"text\":\"### NAT / port forwarding\"},{\"line\":324,\"text\":\"- _WEBADMIN_GigabitEthernet1 permits admin PC [PRIVATE_IP] outbound TCP 80/443.\"},{\"line\":327,\"text\":\"### Router management\"},{\"line\":333,\"text\":\"- Telnet port configured: 2323, security-level private; router log shows Telnet disabled later on 2026-06-26.\"},{\"line\":339,\"text\":\"### Router services\"},{\"line\":354,\"text\":\"### Router automation warning\"},{\"line\":357,\"text\":\"- Automation must use router CLI syntax, not bash syntax.\"},{\"line\":366,\"text\":\"- edge-vm: no UPS/NUT/APCUPSD integration discovered.\"},{\"line\":371,\"text\":\"- NetBird service is active on pve01, pve02, pve03 and edge-vm.\"},{\"line\":376,\"text\":\"- edge-vm: FQDN edge-vm.netbird.selfhosted, IPv4 100.100.60.182/16.\"},{\"line\":395,\"text\":\"- edge-vm owns most application health, dashboard, ingress, backup, NetBox, NPMplus, certificate, Trivy and vulnerability jobs.\"},{\"line\":396,\"text\":\"- pve01 owns many [LONG_REDACTED] VPS/rclone/sops/scrutiny jobs.\"},{\"line\":455,\"text\":\"- edge-vm timers cover runtime dashboard, Paperless guard, external canary, health metrics, restore drill index, AdGuard rewrite sync, NPMplus cert expiry, NetBox backup/sync, retention, cluster daily status, vulnerability and Trivy scans, ingress hardening an\"},{\"line\":456,\"text\":\"- pve01 timers cover VPN/NetBird health, health metrics, smartctl, disk space, MkDocs refresh, VPS identity audit, storage capacity, quality gate, evidence catalog, backup freshness, docker health, Filebrowser backup/offhost/restore, NPMplus/Kuma backup, NetBi\"},{\"line\":459,\"text\":\"- Script hashes were captured for /usr/local/sbin and /usr/local/bin on edge-vm, pve01, pve02 and pve03.\"},{\"line\":531,\"text\":\"- Main active workload: VM130 edge-vm.\"},{\"line\":545,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":560,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":575,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":590,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":597,\"text\":\"### VM130 edge-vm\"},{\"line\":600,\"text\":\"- Name: edge-vm.\"},{\"line\":608,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":626,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":643,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":653,\"text\":\"## [LONG_REDACTED]\"},{\"line\":672,\"text\":\"- git.gram1.ru -> [PRIVATE_IP].\"},{\"line\":682,\"text\":\"### Router ingress\"},{\"line\":683,\"text\":\"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, [PRIVATE_IP].\"},{\"line\":684,\"text\":\"- Router forwards TCP/UDP 3478 to Nextcloud Talk TURN on [PRIVATE_IP].\"},{\"line\":685,\"text\":\"- Router forwards Home TCP/51820 to WireGuard host [PRIVATE_IP].\"},{\"line\":686,\"text\":\"- NPMplus admin listener is bound to localhost on edge-vm, [PRIVATE_IP]:81; public disabled legacy host npm.gram1.ru exists but enabled=0.\"},{\"line\":689,\"text\":\"- Host: edge-vm, [PRIVATE_IP].\"},{\"line\":694,\"text\":\"- Public listen ports on edge-vm: [PRIVATE_IP]:80 and [PRIVATE_IP]:443 by nginx/NPMplus.\"},{\"line\":705,\"text\":\"- git.gram1.ru -> http://[PRIVATE_IP]:3002, cert=29, ssl_forced=1, enabled=1.\"},{\"line\":754,\"text\":\"- cert=29: git.gram1.ru, expires 2026-09-13 17:36:55.\"},{\"line\":762,\"text\":\"- NPMplus schema/listen inventory: [LONG_REDACTED].txt.\"},{\"line\":769,\"text\":\"- Host: edge-vm, IP [PRIVATE_IP].\"},{\"line\":774,\"text\":\"- Public ingress terminates through NPMplus on ports 80/443.\"},{\"line\":826,\"text\":\"- Ingress/security: npmplus, socket-proxy, crowdsec.\"}]\nNEWFI42_TRUST_RELEVANT_LINE_COUNT=37\nNEWFI42_TRUST_RELEVANT_LINES=[{\"line\":1,\"text\":\"# NetBird VPS trust readiness\"},{\"line\":14,\"text\":\"public_ip=188.127.235.6\"},{\"line\":21,\"text\":\"netbird_vps_backup_ok=1\"},{\"line\":22,\"text\":\"netbird_vps_offhost_ok=1\"},{\"line\":23,\"text\":\"netbird_vps_restore_ok=1\"},{\"line\":27,\"text\":\"- Do not use public IP 188.127.235.6 until its host-key mismatch is intentionally resolved.\"},{\"line\":37,\"text\":\"--- HOST=188.127.235.6\"},{\"line\":39,\"text\":\"KNOWN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] |1|/0oIfigkDxhJFJWj72WrkRkYUqo=|29qT4RhgqPPXt3sOwBqw7QrafBY= (ECDSA)\"},{\"line\":40,\"text\":\"KNOWN_FP host=188.127.235.6 3072 SHA256:[LONG_REDACTED] |1|Hmbhg2wXCUS/SDiuLTTgk6Vxhns=|kw5S70w76UhROmk1XT92s4Z757Y= (RSA)\"},{\"line\":41,\"text\":\"KNOWN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] |1|q70vtOfl5nR+CvnLuV7OQ3aEFIo=|OJi44TxJaz3cfw57HO19UEkZc/M= (ED25519)\"},{\"line\":43,\"text\":\"KEYSCAN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] 188.127.235.6 (ED25519)\"},{\"line\":44,\"text\":\"KEYSCAN_FP host=188.127.235.6 3072 SHA256:[LONG_REDACTED] 188.127.235.6 (RSA)\"},{\"line\":45,\"text\":\"KEYSCAN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] 188.127.235.6 (ECDSA)\"},{\"line\":63,\"text\":\"REMOTE_HOSTNAME=edge-vm\"},{\"line\":71,\"text\":\"256 SHA256:[LONG_REDACTED] root@edge-vm (ED25519)\"},{\"line\":72,\"text\":\"256 SHA256:[LONG_REDACTED] root@edge-vm (ECDSA)\"},{\"line\":73,\"text\":\"3072 SHA256:[LONG_REDACTED] root@edge-vm (RSA)\"},{\"line\":77,\"text\":\"REMOTE_HOSTNAME=edge-vm\"},{\"line\":85,\"text\":\"256 SHA256:[LONG_REDACTED] root@edge-vm (ED25519)\"},{\"line\":86,\"text\":\"256 SHA256:[LONG_REDACTED] root@edge-vm (ECDSA)\"},{\"line\":87,\"text\":\"3072 SHA256:[LONG_REDACTED] root@edge-vm (RSA)\"},{\"line\":102,\"text\":\"PUBLIC_STRICT   ssh-keygen -f '[SENSITIVE_PATH] -R '188.127.235.6'\"},{\"line\":103,\"text\":\"PUBLIC_STRICT Host key for 188.127.235.6 has changed and you have requested strict checking.\"},{\"line\":107,\"text\":\"--- [LONG_REDACTED].txt\"},{\"line\":108,\"text\":\"STATUS=OK TS=2026-07-07T15:15:14Z TYPE=external-probe-vps BAD=0 WARN=0 MODE=STRATEGY_ONLY DEPLOYED=NO [LONG_REDACTED] [LONG_REDACTED] BACKUP_HOSTKEYS=no PVE01_PUBLIC_SMOKE_BAD=0 INDEPENDENT_RUNNER=missing [LONG_REDACTED].md\"},{\"line\":109,\"text\":\"--- [LONG_REDACTED].txt\"},{\"line\":111,\"text\":\"SERVICE=netbird-vps-backup\"},{\"line\":113,\"text\":\"VPS_IP=188.127.235.6\"},{\"line\":114,\"text\":\"[LONG_REDACTED]\"},{\"line\":115,\"text\":\"[LONG_REDACTED]\"},{\"line\":119,\"text\":\"--- [LONG_REDACTED].txt\"},{\"line\":121,\"text\":\"SERVICE=netbird-vps-offhost\"},{\"line\":124,\"text\":\"[LONG_REDACTED]\"},{\"line\":129,\"text\":\"--- [LONG_REDACTED].txt\"},{\"line\":131,\"text\":\"SERVICE=netbird-vps-restore-validation\"},{\"line\":134,\"text\":\"[LONG_REDACTED].tgz\"},{\"line\":153,\"text\":\"edge-vm service=active/enabled wt0_ip=100.100.60.182/16 management=yes signal=yes peers=6/9 Connected\"}]\nNEWFI42_TEXT_FILES_SCANNED=336\nNEWFI42_TOPOLOGY_MATCH_FILE_COUNT=50\nNEWFI42_TOPOLOGY_MATCH_FILES_TRUNCATED=false\nNEWFI42_TOPOLOGY_MATCH_FILES=[{\"path\":\"/etc/pve/.rrd\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/etc/pve/HOMEPAGE_BACKUP_COVERAGE_MATRIX.md.bak-corrected-20260630T185336Z\",\"tags\":[\"ROUTER\"]},{\"path\":\"/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md\",\"tags\":[\"REJECTED_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/etc/pve/HOMEPAGE_BACKUP_COVERAGE_MATRIX.md\",\"tags\":[\"ROUTER\"]},{\"path\":\"/etc/pve/31_HOMELAB_REFERENCE.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-router-cli-20260630T215229Z\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md\",\"tags\":[\"REJECTED_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak.20260721T112115Z\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/etc/pve/HOMELAB_CLUSTER_BACKLOG.md\",\"tags\":[\"EDGE_VM\",\"ROUTER\"]},{\"path\":\"/etc/pve/HOMEPAGE_BACKUP_GAP_CLASSIFICATION.md\",\"tags\":[\"ROUTER\"]},{\"path\":\"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"STAGING_HOST\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-proof-repair-20260630T215529Z\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/etc/pve/priv/authorized_keys\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\"]},{\"path\":\"/etc/pve/nodes/pve03/qemu-server/130.conf\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/var/lib/homelab-netbird-vps-trust/closure-latest.md\",\"tags\":[\"REJECTED_IP\",\"EDGE_VM\",\"NAT_FORWARD\"]},{\"path\":\"/var/lib/homelab-netbird-vps-trust/latest.md\",\"tags\":[\"REJECTED_IP\",\"EDGE_VM\"]},{\"path\":\"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md\",\"tags\":[\"REJECTED_IP\",\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/observed/cluster-guests.json\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/observed/source-snapshots/dependency-map-latest.tsv\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/inventory/access-paths.json\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/changes/CR-2026-0081/home-forward-retire-package.sha256\",\"tags\":[\"PUBLIC_80_443\"]},{\"path\":\"/srv/homelab-ops/changes/CR-2026-0018/design.md\",\"tags\":[\"NAT_FORWARD\"]},{\"path\":\"/srv/homelab-ops/changes/CR-2026-0080/task-package.sha256\",\"tags\":[\"NAT_FORWARD\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-vm150-rebuild-v2/task.json\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/skladchik-reports-monitor-controlled-reauth-v1/assets/pve01/skladchik-reports-monitor-status\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/tasks/skladchik-reports-monitor-controlled-reauth-v1/assets/pve01/skladchik-reports-monitor-monthly-selftest-watch\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/task.json\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/README.txt\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-home-restricted-ingress.nft\",\"tags\":[\"PUBLIC_IP\",\"NAT_FORWARD\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-public-ingress.nft\",\"tags\":[\"PUBLIC_IP\",\"NAT_FORWARD\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/tools/cutover.py\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/task.json\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/README.txt\",\"tags\":[\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/tools/retire_home_forwards.py\",\"tags\":[\"PUBLIC_IP\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/task.json\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/README.txt\",\"tags\":[\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/tools/retire_turn_dns.py\",\"tags\":[\"PUBLIC_IP\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-post-cutover-hardening-design.md\",\"tags\":[\"PUBLIC_IP\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/specs/2026-08-18-gitea-edge-publisher-v3-design-v1.1.md\",\"tags\":[\"NAT_FORWARD\",\"TUNNEL\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-edge-cutover-design.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-18-gitea-edge-publisher-v3.md\",\"tags\":[\"PUBLIC_IP\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-home-forward-retirement.md\",\"tags\":[\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-edge-cutover.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-turn-legacy-dns-retirement.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/kb/AI_CONTEXT.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/kb/inventory/guests.json\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\",\"TUNNEL\"]},{\"path\":\"/srv/homelab-ops/kb/runbooks/03_EDGE_NGINX.md\",\"tags\":[\"PUBLIC_IP\"]},{\"path\":\"/srv/homelab-ops/tests/test_cr_2026_0080_snikket_edge_cutover.py\",\"tags\":[\"PUBLIC_IP\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tests/test_cr_2026_0081_turn_dns_retire.py\",\"tags\":[\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tests/test_cr_2026_0081_home_forward_retire.py\",\"tags\":[\"PUBLIC_IP\",\"ROUTER\"]}]\nNEWFI42_OPS_GIT_STATUS_RC=0\nNEWFI42_OPS_GIT_STATUS_SHA256=5fbcb2990ad25e368c12219bf3ddca36e464d044e7acac16696fa8cd54159185\nNEWFI42_OPS_GIT_HEAD_RC=0\nNEWFI42_OPS_GIT_HEAD=d5e2ef5639398a762283e47143c17b494f8ed579\nNEWFI42_NETWORK_RELATED_UNIT_QUERY_RC=0\nNEWFI42_NETWORK_RELATED_UNITS=[{\"unit\":\"\\u25cf\",\"load\":\"gssproxy.service\",\"active\":\"not-found\",\"sub\":\"inactive\"},{\"unit\":\"netbird-peers-health.service\",\"load\":\"loaded\",\"active\":\"inactive\",\"sub\":\"dead\"},{\"unit\":\"netbird.service\",\"load\":\"loaded\",\"active\":\"active\",\"sub\":\"running\"},{\"unit\":\"pveproxy.service\",\"load\":\"loaded\",\"active\":\"active\",\"sub\":\"running\"},{\"unit\":\"spiceproxy.service\",\"load\":\"loaded\",\"active\":\"active\",\"sub\":\"running\"},{\"unit\":\"systemd-ask-password-wall.service\",\"load\":\"loaded\",\"active\":\"inactive\",\"sub\":\"dead\"}]\nNEWFI42_NFT_QUERY_RC=0\nNEWFI42_NFT_RELEVANT_RULE_COUNT=0\nNEWFI42_NFT_RELEVANT_LOCATIONS=[]\nNEWFI42_ROUTE_TO_PUBLIC_IP_RC=0\nNEWFI42_ROUTE_TO_PUBLIC_IP={\"dev\":\"vmbr0\",\"gateway_present\":true,\"gateway_sha256\":\"4f9da1283166a1e9f4e6bc7dd240c76aef85772177f717f92abb6e8e2bb8de90\",\"prefsrc_sha256\":\"fb345731d21c612ed2cb13088c10fd26bac959c79a7634cb55e23ee6bfb428d9\"}\nNEWFI42_DNS_A={\"newfi-staging.gram1.ru\":{\"ips\":[\"185.225.35.6\"],\"sources\":[\"getent\",\"dig\"]},\"chat.gram1.ru\":{\"ips\":[\"[PRIVATE_IP]\"],\"sources\":[\"getent\",\"dig\"]},\"git.gram1.ru\":{\"ips\":[\"[PRIVATE_IP]\"],\"sources\":[\"getent\",\"dig\"]},\"newfi.ru\":{\"ips\":[\"185.225.35.6\"],\"sources\":[\"getent\",\"dig\"]}}\nNEWFI42_DNS_STAGE_SHARES_IP_WITH_CHAT=false\nNEWFI42_DNS_STAGE_SHARES_IP_WITH_GIT=false\nNEWFI42_AUTHORITY_FORWARDING_ASSERTION_PRESENT=true\nNEWFI42_LOCAL_FORWARDING_RELATED_FILE_EVIDENCE=true\nNEWFI42_EXPLICIT_PUBLIC_IP_CONFIG_REFERENCE=true\nNEWFI42_DECISION=PUBLIC_INGRESS_CONTROL_PLANE_REFERENCE_FOUND_REVIEW_EXACT_MATCHED_PATHS_BEFORE_FIX\nNEWFI42_KNOWN_HOSTS_SHA256_AFTER=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735\nNEWFI42_KNOWN_HOSTS_UNCHANGED=true\nNEWFI42_CHANGES_MADE=false\nNEWFI42_MUTATION_SCOPE=NONE_READ_ONLY\nNEWFI42_RCA_EXECUTION=PASS\n"
+}
diff --git a/runtime/history/NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-TOPOLOGY-RCA42.txt b/runtime/history/NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-TOPOLOGY-RCA42.txt
new file mode 100644
index 00000000..49976ec0
--- /dev/null
+++ b/runtime/history/NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-TOPOLOGY-RCA42.txt
@@ -0,0 +1,74 @@
+CHAT_OUTPUT_BEGIN
+COMMAND_ID=NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-TOPOLOGY-RCA42
+STATUS=OK
+RC=0
+HOST=pve01
+MODE=read-only
+COMPONENT=newfi-stagingedge-public-ingress-topology-rca-v6
+REFERENCE_REGISTER_CHECK=OK
+REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
+ERROR_REGISTER_CHECK=OK
+ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
+COMMAND_SHA256=8c1deae24d2c2e50bd7eca16ab18b10c78eb623b43884a033be8abcb060328de
+DUPLICATE_FAILED_COMMAND_BLOCKED=false
+EXECUTION_STARTED=true
+CHANGE_DECLARED=false
+RESULT_CONTRACT_VALID=true
+RESULT_CONTRACT_STATUS=NOT_APPLICABLE
+RESULT_CONTRACT_ERROR=NONE
+COMMAND_RC=0
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=NO_MUTATION
+SANITIZED=yes
+SECRETS_INCLUDED=no
+PRIVATE_ADDRESSES_INCLUDED=no
+RAW_EVIDENCE_SHA256=475297be47aae03d0ef913ed8d3c90d3f0eabe4b0a86b02e6cccd5e805171e4f
+SANITIZED_OUTPUT_SHA256=2740dbcc0eb7d919991be01db110d70f85f1c7ab59bcebf520b56960fa9399f9
+OUTPUT_BEGIN
+ERROR_REGISTER_CHECK=OK
+REFERENCE_CHECK=OK
+AUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED
+NEWFI42_RUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d
+NEWFI42_KNOWN_HOSTS_SHA256_BEFORE=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735
+NEWFI42_TRUST_FILE_PRESENT=true
+NEWFI42_TRUST_FILE_SHA256=5ff80132df401240519f48091ed62c139183c325000ef7dd253e7f676a539b2c
+NEWFI42_TRUST_EDGEVM_MARKER=true
+NEWFI42_TRUST_REJECTED_MARKER=false
+NEWFI42_ERROR_RELEVANT_LINE_COUNT=50
+NEWFI42_ERROR_RELEVANT_LINES=[{"line":19,"text":"CHECK-8: для edge-vm использовать debian@[PRIVATE_IP] и sudo."},{"line":28,"text":"VM130 edge-vm has secondary disk backup=0 risk."},{"line":52,"text":"edge-vm: ssh debian@[PRIVATE_IP], внутри использовать sudo."},{"line":170,"text":"41. Ошибка: post-backup-pass-slo-reconciliation checked pve01 router health on edge-vm."},{"line":171,"text":"Факт: first reconciliation wrote STATUS=ERROR because router-running-config-mail-cloud.txt is on pve01, not edge-vm."},{"line":172,"text":"Fix: build reconciliation from pve01 and edge-vm health files by correct owner."},{"line":213,"text":"## ROUTER_CLI_STDIN_APPLY_FAILURE_20260630"},{"line":214,"text":"- Context: attempted Netcraze router ACL apply through SSH stdin/multiline for Homepage Moscow Router monitor fix."},{"line":215,"text":"- Evidence: [LONG_REDACTED].txt."},{"line":219,"text":"## [LONG_REDACTED]"},{"line":221,"text":"- Evidence: [LONG_REDACTED].txt showed COMMAND_COUNT=1."},{"line":224,"text":"## [LONG_REDACTED]"},{"line":225,"text":"- Context: routerbackup user can run show running-config but cannot execute configuration commands such as access-list."},{"line":226,"text":"- Evidence: [LONG_REDACTED].txt."},{"line":228,"text":"- Rule: do not attempt ACL/config changes as routerbackup; use admin/operator router access or router Web UI for write changes."},{"line":232,"text":"- Evidence: [LONG_REDACTED].txt has blank [LONG_REDACTED] fields."},{"line":235,"text":"## [LONG_REDACTED]"},{"line":236,"text":"- Context: while moving Moscow Router monitor rules to _WEBADMIN_Bridge1, two _WEBADMIN_Bridge0 Nextcloud Talk TURN rules were accidentally removed."},{"line":238,"text":"- Verification proof: 399_ROUTER_ACL_RESTORE_AFTER_UI_PROOF.txt."},{"line":239,"text":"- Rule: after manual router Web UI ACL edits, compare _WEBADMIN_Bridge0, _WEBADMIN_Bridge1 and _WEBADMIN_GigabitEthernet1 before continuing."},{"line":241,"text":"## [LONG_REDACTED]"},{"line":242,"text":"- Context: proof 400 tested Moscow router HTTPS monitor from Homepage container with custom Node lookup callback."},{"line":247,"text":"## [LONG_REDACTED]"},{"line":248,"text":"- Context: Moscow Router Homepage monitor after ACL fix."},{"line":250,"text":"- Observed: edge-vm TCP to [PRIVATE_IP]:5080/5083 is OK, but router HTTP/HTTPS returns 403 for all tested paths."},{"line":251,"text":"- Impact: Homepage siteMonitor cannot be made green via direct router HTTP URL until router web service allows the Bridge1/Proxmox/protected segment or an explicit safe monitor endpoint is used."},{"line":255,"text":"- Context: installing edge-vm Moscow router health endpoint."},{"line":261,"text":"## [LONG_REDACTED]"},{"line":262,"text":"- Context: Moscow Router Homepage siteMonitor attempt using http://[PRIVATE_IP]:5080."},{"line":264,"text":"- Impact: do not use [PRIVATE_IP] directly as Homepage siteMonitor from edge-vm."},{"line":265,"text":"- Mitigation: use dedicated edge-vm health endpoint that checks router TCP [PRIVATE_IP]:5080 and returns HTTP 200/503 for Homepage."},{"line":267,"text":"## [LONG_REDACTED]"},{"line":268,"text":"- Context: applying Moscow Router Homepage siteMonitor health endpoint."},{"line":273,"text":"## [LONG_REDACTED]"},{"line":274,"text":"- Context: applying Moscow Router Homepage health endpoint."},{"line":276,"text":"- Evidence: proof 408 showed SyntaxError in /tmp/homepage-router-moscow-apply-fixed.py."},{"line":582,"text":"- Context: pvepro.ru root/www currently point to the Mailcow VPS and return Mailcow with TLS hostname mismatch."},{"line":583,"text":"- Decision: because pve01 has no SSH key access to the external VPS, do not modify the VPS. Instead move only pvepro.ru and www.pvepro.ru A records to edge and serve an edge landing page."},{"line":598,"text":"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router."},{"line":599,"text":"- Current limitation: there is no safe private remote access path to the dacha router yet."},{"line":600,"text":"- Rule: do not expose router admin publicly and do not attempt certificate deployment to the router over the public internet."},{"line":604,"text":"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router."},{"line":605,"text":"- Current limitation: there is no safe private remote access path to the dacha router yet."},{"line":606,"text":"- Rule: do not expose router admin publicly and do not attempt certificate deployment to the router over the public internet."},{"line":610,"text":"- Context: configuring private management path for taftauto.ru dacha router."},{"line":612,"text":"- Rule: generated client config may be stored only as root/debian mode 600 file and must be imported into the Netcraze router UI manually."},{"line":613,"text":"- Rule: do not open router public admin or certificate deployment until WireGuard handshake is proven."},{"line":626,"text":"- Fix: rebuild SmartApe under External Homelabs with 2-space item indentation, remove Router Moscow, rebuild Sites category."},{"line":647,"text":"## [LONG_REDACTED]"},{"line":648,"text":"- Previous apply looked for Russian Router card name, but active Homepage Useful group contains Router and Public Domain."}]
+NEWFI42_REFERENCE_RELEVANT_LINE_COUNT=50
+NEWFI42_REFERENCE_RELEVANT_LINES=[{"line":14,"text":"- VM130 edge-vm | pve03 | running | KEEP"},{"line":75,"text":"NOTE edge-vm disk scsi1 backup=0 risk must be documented"},{"line":90,"text":"HEALTH_NOT_OK item=ingress-dns-route-slo.txt line=STATUS=WARN"},{"line":149,"text":"- У VM130 edge-vm есть риск: дополнительный диск backup=0."},{"line":166,"text":"- VM130 edge-vm pve03 [PRIVATE_IP] Docker ingress/app host."},{"line":199,"text":"## ROUTER_NETCRAZE_ULTRA_NC1812_20260630"},{"line":234,"text":"- WAN DHCP observed in router log: 95.84.154.183/23, gateway 95.84.154.1."},{"line":235,"text":"- ISP DNS observed in router log: 77.37.251.33, 77.37.255.30."},{"line":282,"text":"- Default router: [PRIVATE_IP]."},{"line":312,"text":"- [PRIVATE_IP] -> bc:24:11:e1:f3:3c NPMplus / edge-vm."},{"line":315,"text":"### NAT / port forwarding"},{"line":324,"text":"- _WEBADMIN_GigabitEthernet1 permits admin PC [PRIVATE_IP] outbound TCP 80/443."},{"line":327,"text":"### Router management"},{"line":333,"text":"- Telnet port configured: 2323, security-level private; router log shows Telnet disabled later on 2026-06-26."},{"line":339,"text":"### Router services"},{"line":354,"text":"### Router automation warning"},{"line":357,"text":"- Automation must use router CLI syntax, not bash syntax."},{"line":366,"text":"- edge-vm: no UPS/NUT/APCUPSD integration discovered."},{"line":371,"text":"- NetBird service is active on pve01, pve02, pve03 and edge-vm."},{"line":376,"text":"- edge-vm: FQDN edge-vm.netbird.selfhosted, IPv4 100.100.60.182/16."},{"line":395,"text":"- edge-vm owns most application health, dashboard, ingress, backup, NetBox, NPMplus, certificate, Trivy and vulnerability jobs."},{"line":396,"text":"- pve01 owns many [LONG_REDACTED] VPS/rclone/sops/scrutiny jobs."},{"line":455,"text":"- edge-vm timers cover runtime dashboard, Paperless guard, external canary, health metrics, restore drill index, AdGuard rewrite sync, NPMplus cert expiry, NetBox backup/sync, retention, cluster daily status, vulnerability and Trivy scans, ingress hardening an"},{"line":456,"text":"- pve01 timers cover VPN/NetBird health, health metrics, smartctl, disk space, MkDocs refresh, VPS identity audit, storage capacity, quality gate, evidence catalog, backup freshness, docker health, Filebrowser backup/offhost/restore, NPMplus/Kuma backup, NetBi"},{"line":459,"text":"- Script hashes were captured for /usr/local/sbin and /usr/local/bin on edge-vm, pve01, pve02 and pve03."},{"line":531,"text":"- Main active workload: VM130 edge-vm."},{"line":545,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":560,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":575,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":590,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":597,"text":"### VM130 edge-vm"},{"line":600,"text":"- Name: edge-vm."},{"line":608,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":626,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":643,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":653,"text":"## [LONG_REDACTED]"},{"line":672,"text":"- git.gram1.ru -> [PRIVATE_IP]."},{"line":682,"text":"### Router ingress"},{"line":683,"text":"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, [PRIVATE_IP]."},{"line":684,"text":"- Router forwards TCP/UDP 3478 to Nextcloud Talk TURN on [PRIVATE_IP]."},{"line":685,"text":"- Router forwards Home TCP/51820 to WireGuard host [PRIVATE_IP]."},{"line":686,"text":"- NPMplus admin listener is bound to localhost on edge-vm, [PRIVATE_IP]:81; public disabled legacy host npm.gram1.ru exists but enabled=0."},{"line":689,"text":"- Host: edge-vm, [PRIVATE_IP]."},{"line":694,"text":"- Public listen ports on edge-vm: [PRIVATE_IP]:80 and [PRIVATE_IP]:443 by nginx/NPMplus."},{"line":705,"text":"- git.gram1.ru -> http://[PRIVATE_IP]:3002, cert=29, ssl_forced=1, enabled=1."},{"line":754,"text":"- cert=29: git.gram1.ru, expires 2026-09-13 17:36:55."},{"line":762,"text":"- NPMplus schema/listen inventory: [LONG_REDACTED].txt."},{"line":769,"text":"- Host: edge-vm, IP [PRIVATE_IP]."},{"line":774,"text":"- Public ingress terminates through NPMplus on ports 80/443."},{"line":826,"text":"- Ingress/security: npmplus, socket-proxy, crowdsec."}]
+NEWFI42_TRUST_RELEVANT_LINE_COUNT=37
+NEWFI42_TRUST_RELEVANT_LINES=[{"line":1,"text":"# NetBird VPS trust readiness"},{"line":14,"text":"public_ip=188.127.235.6"},{"line":21,"text":"netbird_vps_backup_ok=1"},{"line":22,"text":"netbird_vps_offhost_ok=1"},{"line":23,"text":"netbird_vps_restore_ok=1"},{"line":27,"text":"- Do not use public IP 188.127.235.6 until its host-key mismatch is intentionally resolved."},{"line":37,"text":"--- HOST=188.127.235.6"},{"line":39,"text":"KNOWN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] |1|/0oIfigkDxhJFJWj72WrkRkYUqo=|29qT4RhgqPPXt3sOwBqw7QrafBY= (ECDSA)"},{"line":40,"text":"KNOWN_FP host=188.127.235.6 3072 SHA256:[LONG_REDACTED] |1|Hmbhg2wXCUS/SDiuLTTgk6Vxhns=|kw5S70w76UhROmk1XT92s4Z757Y= (RSA)"},{"line":41,"text":"KNOWN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] |1|q70vtOfl5nR+CvnLuV7OQ3aEFIo=|OJi44TxJaz3cfw57HO19UEkZc/M= (ED25519)"},{"line":43,"text":"KEYSCAN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] 188.127.235.6 (ED25519)"},{"line":44,"text":"KEYSCAN_FP host=188.127.235.6 3072 SHA256:[LONG_REDACTED] 188.127.235.6 (RSA)"},{"line":45,"text":"KEYSCAN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] 188.127.235.6 (ECDSA)"},{"line":63,"text":"REMOTE_HOSTNAME=edge-vm"},{"line":71,"text":"256 SHA256:[LONG_REDACTED] root@edge-vm (ED25519)"},{"line":72,"text":"256 SHA256:[LONG_REDACTED] root@edge-vm (ECDSA)"},{"line":73,"text":"3072 SHA256:[LONG_REDACTED] root@edge-vm (RSA)"},{"line":77,"text":"REMOTE_HOSTNAME=edge-vm"},{"line":85,"text":"256 SHA256:[LONG_REDACTED] root@edge-vm (ED25519)"},{"line":86,"text":"256 SHA256:[LONG_REDACTED] root@edge-vm (ECDSA)"},{"line":87,"text":"3072 SHA256:[LONG_REDACTED] root@edge-vm (RSA)"},{"line":102,"text":"PUBLIC_STRICT   ssh-keygen -f '[SENSITIVE_PATH] -R '188.127.235.6'"},{"line":103,"text":"PUBLIC_STRICT Host key for 188.127.235.6 has changed and you have requested strict checking."},{"line":107,"text":"--- [LONG_REDACTED].txt"},{"line":108,"text":"STATUS=OK TS=2026-07-07T15:15:14Z TYPE=external-probe-vps BAD=0 WARN=0 MODE=STRATEGY_ONLY DEPLOYED=NO [LONG_REDACTED] [LONG_REDACTED] BACKUP_HOSTKEYS=no PVE01_PUBLIC_SMOKE_BAD=0 INDEPENDENT_RUNNER=missing [LONG_REDACTED].md"},{"line":109,"text":"--- [LONG_REDACTED].txt"},{"line":111,"text":"SERVICE=netbird-vps-backup"},{"line":113,"text":"VPS_IP=188.127.235.6"},{"line":114,"text":"[LONG_REDACTED]"},{"line":115,"text":"[LONG_REDACTED]"},{"line":119,"text":"--- [LONG_REDACTED].txt"},{"line":121,"text":"SERVICE=netbird-vps-offhost"},{"line":124,"text":"[LONG_REDACTED]"},{"line":129,"text":"--- [LONG_REDACTED].txt"},{"line":131,"text":"SERVICE=netbird-vps-restore-validation"},{"line":134,"text":"[LONG_REDACTED].tgz"},{"line":153,"text":"edge-vm service=active/enabled wt0_ip=100.100.60.182/16 management=yes signal=yes peers=6/9 Connected"}]
+NEWFI42_TEXT_FILES_SCANNED=336
+NEWFI42_TOPOLOGY_MATCH_FILE_COUNT=50
+NEWFI42_TOPOLOGY_MATCH_FILES_TRUNCATED=false
+NEWFI42_TOPOLOGY_MATCH_FILES=[{"path":"/etc/pve/.rrd","tags":["EDGE_VM"]},{"path":"/etc/pve/HOMEPAGE_BACKUP_COVERAGE_MATRIX.md.bak-corrected-20260630T185336Z","tags":["ROUTER"]},{"path":"/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","tags":["REJECTED_IP","EDGE_VM","PUBLIC_80_443","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/etc/pve/HOMEPAGE_BACKUP_COVERAGE_MATRIX.md","tags":["ROUTER"]},{"path":"/etc/pve/31_HOMELAB_REFERENCE.md","tags":["PUBLIC_IP","EDGE_VM","PUBLIC_80_443","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-router-cli-20260630T215229Z","tags":["EDGE_VM","NAT_FORWARD","ROUTER"]},{"path":"/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md","tags":["REJECTED_IP","EDGE_VM","PUBLIC_80_443","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak.20260721T112115Z","tags":["EDGE_VM","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/etc/pve/HOMELAB_CLUSTER_BACKLOG.md","tags":["EDGE_VM","ROUTER"]},{"path":"/etc/pve/HOMEPAGE_BACKUP_GAP_CLASSIFICATION.md","tags":["ROUTER"]},{"path":"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md","tags":["PUBLIC_IP","EDGE_VM","STAGING_HOST","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-proof-repair-20260630T215529Z","tags":["EDGE_VM","NAT_FORWARD","ROUTER"]},{"path":"/etc/pve/priv/authorized_keys","tags":["EDGE_VM","NAT_FORWARD"]},{"path":"/etc/pve/nodes/pve03/qemu-server/130.conf","tags":["EDGE_VM"]},{"path":"/var/lib/homelab-netbird-vps-trust/closure-latest.md","tags":["REJECTED_IP","EDGE_VM","NAT_FORWARD"]},{"path":"/var/lib/homelab-netbird-vps-trust/latest.md","tags":["REJECTED_IP","EDGE_VM"]},{"path":"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md","tags":["REJECTED_IP","EDGE_VM"]},{"path":"/srv/homelab-ops/observed/cluster-guests.json","tags":["EDGE_VM"]},{"path":"/srv/homelab-ops/observed/source-snapshots/dependency-map-latest.tsv","tags":["EDGE_VM"]},{"path":"/srv/homelab-ops/inventory/access-paths.json","tags":["EDGE_VM"]},{"path":"/srv/homelab-ops/changes/CR-2026-0081/home-forward-retire-package.sha256","tags":["PUBLIC_80_443"]},{"path":"/srv/homelab-ops/changes/CR-2026-0018/design.md","tags":["NAT_FORWARD"]},{"path":"/srv/homelab-ops/changes/CR-2026-0080/task-package.sha256","tags":["NAT_FORWARD"]},{"path":"/srv/homelab-ops/tasks/snikket-vm150-rebuild-v2/task.json","tags":["EDGE_VM","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/tasks/skladchik-reports-monitor-controlled-reauth-v1/assets/pve01/skladchik-reports-monitor-status","tags":["EDGE_VM"]},{"path":"/srv/homelab-ops/tasks/skladchik-reports-monitor-controlled-reauth-v1/assets/pve01/skladchik-reports-monitor-monthly-selftest-watch","tags":["EDGE_VM"]},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/task.json","tags":["PUBLIC_IP","EDGE_VM","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/README.txt","tags":["PUBLIC_IP","EDGE_VM","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-home-restricted-ingress.nft","tags":["PUBLIC_IP","NAT_FORWARD"]},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-public-ingress.nft","tags":["PUBLIC_IP","NAT_FORWARD"]},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/tools/cutover.py","tags":["PUBLIC_IP","EDGE_VM","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/task.json","tags":["PUBLIC_IP","EDGE_VM","PUBLIC_80_443","ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/README.txt","tags":["ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/tools/retire_home_forwards.py","tags":["PUBLIC_IP","ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/task.json","tags":["PUBLIC_IP","EDGE_VM","ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/README.txt","tags":["ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/tools/retire_turn_dns.py","tags":["PUBLIC_IP"]},{"path":"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-post-cutover-hardening-design.md","tags":["PUBLIC_IP","ROUTER"]},{"path":"/srv/homelab-ops/docs/superpowers/specs/2026-08-18-gitea-edge-publisher-v3-design-v1.1.md","tags":["NAT_FORWARD","TUNNEL"]},{"path":"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-edge-cutover-design.md","tags":["PUBLIC_IP","EDGE_VM","PUBLIC_80_443","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-18-gitea-edge-publisher-v3.md","tags":["PUBLIC_IP"]},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-home-forward-retirement.md","tags":["PUBLIC_80_443","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-edge-cutover.md","tags":["PUBLIC_IP","EDGE_VM","PUBLIC_80_443","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-turn-legacy-dns-retirement.md","tags":["PUBLIC_IP","EDGE_VM","ROUTER"]},{"path":"/srv/homelab-ops/kb/AI_CONTEXT.md","tags":["PUBLIC_IP","EDGE_VM"]},{"path":"/srv/homelab-ops/kb/inventory/guests.json","tags":["EDGE_VM","NAT_FORWARD","TUNNEL"]},{"path":"/srv/homelab-ops/kb/runbooks/03_EDGE_NGINX.md","tags":["PUBLIC_IP"]},{"path":"/srv/homelab-ops/tests/test_cr_2026_0080_snikket_edge_cutover.py","tags":["PUBLIC_IP","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/tests/test_cr_2026_0081_turn_dns_retire.py","tags":["ROUTER"]},{"path":"/srv/homelab-ops/tests/test_cr_2026_0081_home_forward_retire.py","tags":["PUBLIC_IP","ROUTER"]}]
+NEWFI42_OPS_GIT_STATUS_RC=0
+NEWFI42_OPS_GIT_STATUS_SHA256=5fbcb2990ad25e368c12219bf3ddca36e464d044e7acac16696fa8cd54159185
+NEWFI42_OPS_GIT_HEAD_RC=0
+NEWFI42_OPS_GIT_HEAD=d5e2ef5639398a762283e47143c17b494f8ed579
+NEWFI42_NETWORK_RELATED_UNIT_QUERY_RC=0
+NEWFI42_NETWORK_RELATED_UNITS=[{"unit":"\u25cf","load":"gssproxy.service","active":"not-found","sub":"inactive"},{"unit":"netbird-peers-health.service","load":"loaded","active":"inactive","sub":"dead"},{"unit":"netbird.service","load":"loaded","active":"active","sub":"running"},{"unit":"pveproxy.service","load":"loaded","active":"active","sub":"running"},{"unit":"spiceproxy.service","load":"loaded","active":"active","sub":"running"},{"unit":"systemd-ask-password-wall.service","load":"loaded","active":"inactive","sub":"dead"}]
+NEWFI42_NFT_QUERY_RC=0
+NEWFI42_NFT_RELEVANT_RULE_COUNT=0
+NEWFI42_NFT_RELEVANT_LOCATIONS=[]
+NEWFI42_ROUTE_TO_PUBLIC_IP_RC=0
+NEWFI42_ROUTE_TO_PUBLIC_IP={"dev":"vmbr0","gateway_present":true,"gateway_sha256":"4f9da1283166a1e9f4e6bc7dd240c76aef85772177f717f92abb6e8e2bb8de90","prefsrc_sha256":"fb345731d21c612ed2cb13088c10fd26bac959c79a7634cb55e23ee6bfb428d9"}
+NEWFI42_DNS_A={"newfi-staging.gram1.ru":{"ips":["185.225.35.6"],"sources":["getent","dig"]},"chat.gram1.ru":{"ips":["[PRIVATE_IP]"],"sources":["getent","dig"]},"git.gram1.ru":{"ips":["[PRIVATE_IP]"],"sources":["getent","dig"]},"newfi.ru":{"ips":["185.225.35.6"],"sources":["getent","dig"]}}
+NEWFI42_DNS_STAGE_SHARES_IP_WITH_CHAT=false
+NEWFI42_DNS_STAGE_SHARES_IP_WITH_GIT=false
+NEWFI42_AUTHORITY_FORWARDING_ASSERTION_PRESENT=true
+NEWFI42_LOCAL_FORWARDING_RELATED_FILE_EVIDENCE=true
+NEWFI42_EXPLICIT_PUBLIC_IP_CONFIG_REFERENCE=true
+NEWFI42_DECISION=PUBLIC_INGRESS_CONTROL_PLANE_REFERENCE_FOUND_REVIEW_EXACT_MATCHED_PATHS_BEFORE_FIX
+NEWFI42_KNOWN_HOSTS_SHA256_AFTER=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735
+NEWFI42_KNOWN_HOSTS_UNCHANGED=true
+NEWFI42_CHANGES_MADE=false
+NEWFI42_MUTATION_SCOPE=NONE_READ_ONLY
+NEWFI42_RCA_EXECUTION=PASS
+
+OUTPUT_END
+CHAT_OUTPUT_END
diff --git a/runtime/latest.json b/runtime/latest.json
index bdf91edb..2568b9d3 100644
--- a/runtime/latest.json
+++ b/runtime/latest.json
@@ -1 +1,38 @@
-{"schema_version":1,"channel":"homelab-runtime","command_id":"CONTEXT-AUTO-20260908T181701Z","status":"OK","rc":0,"host":"pve01","mode":"read-only","component":"cluster-context","started_at_utc":"2026-09-08T18:17:01Z","finished_at_utc":"2026-09-08T18:17:02Z","reference_register_checked":true,"reference_sha256":"5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66","error_register_checked":true,"error_register_sha256":"3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0","changes_made":false,"sanitized":true,"secrets_included":false,"private_addresses_included":false,"output":"AUTOMATIC_CLUSTER_CONTEXT_REFRESH=OK"}
+{
+  "schema_version": 1,
+  "channel": "homelab-runtime",
+  "command_id": "NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-TOPOLOGY-RCA42",
+  "status": "OK",
+  "rc": 0,
+  "host": "pve01",
+  "mode": "read-only",
+  "component": "newfi-stagingedge-public-ingress-topology-rca-v6",
+  "started_at_utc": "2026-09-08T18:19:52Z",
+  "finished_at_utc": "2026-09-08T18:19:52Z",
+  "reference_register_checked": true,
+  "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
+  "error_register_checked": true,
+  "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
+  "command_sha256": "8c1deae24d2c2e50bd7eca16ab18b10c78eb623b43884a033be8abcb060328de",
+  "duplicate_failed_command_blocked": false,
+  "block_reason": null,
+  "execution_started": true,
+  "change_declared": false,
+  "result_contract_valid": true,
+  "result_contract_status": null,
+  "result_contract_error": null,
+  "command_rc": 0,
+  "changes_made": false,
+  "rollback_started": false,
+  "rollback_restored": null,
+  "mutation_outcome": "NO_MUTATION",
+  "sanitized": true,
+  "secrets_included": false,
+  "private_addresses_included": false,
+  "raw_evidence_retained_locally": true,
+  "raw_evidence_sha256": "475297be47aae03d0ef913ed8d3c90d3f0eabe4b0a86b02e6cccd5e805171e4f",
+  "sanitized_output_sha256": "2740dbcc0eb7d919991be01db110d70f85f1c7ab59bcebf520b56960fa9399f9",
+  "output_truncated_in_json": false,
+  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
+  "output": "ERROR_REGISTER_CHECK=OK\nREFERENCE_CHECK=OK\nAUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED\nNEWFI42_RUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\nNEWFI42_KNOWN_HOSTS_SHA256_BEFORE=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735\nNEWFI42_TRUST_FILE_PRESENT=true\nNEWFI42_TRUST_FILE_SHA256=5ff80132df401240519f48091ed62c139183c325000ef7dd253e7f676a539b2c\nNEWFI42_TRUST_EDGEVM_MARKER=true\nNEWFI42_TRUST_REJECTED_MARKER=false\nNEWFI42_ERROR_RELEVANT_LINE_COUNT=50\nNEWFI42_ERROR_RELEVANT_LINES=[{\"line\":19,\"text\":\"CHECK-8: для edge-vm использовать debian@[PRIVATE_IP] и sudo.\"},{\"line\":28,\"text\":\"VM130 edge-vm has secondary disk backup=0 risk.\"},{\"line\":52,\"text\":\"edge-vm: ssh debian@[PRIVATE_IP], внутри использовать sudo.\"},{\"line\":170,\"text\":\"41. Ошибка: post-backup-pass-slo-reconciliation checked pve01 router health on edge-vm.\"},{\"line\":171,\"text\":\"Факт: first reconciliation wrote STATUS=ERROR because router-running-config-mail-cloud.txt is on pve01, not edge-vm.\"},{\"line\":172,\"text\":\"Fix: build reconciliation from pve01 and edge-vm health files by correct owner.\"},{\"line\":213,\"text\":\"## ROUTER_CLI_STDIN_APPLY_FAILURE_20260630\"},{\"line\":214,\"text\":\"- Context: attempted Netcraze router ACL apply through SSH stdin/multiline for Homepage Moscow Router monitor fix.\"},{\"line\":215,\"text\":\"- Evidence: [LONG_REDACTED].txt.\"},{\"line\":219,\"text\":\"## [LONG_REDACTED]\"},{\"line\":221,\"text\":\"- Evidence: [LONG_REDACTED].txt showed COMMAND_COUNT=1.\"},{\"line\":224,\"text\":\"## [LONG_REDACTED]\"},{\"line\":225,\"text\":\"- Context: routerbackup user can run show running-config but cannot execute configuration commands such as access-list.\"},{\"line\":226,\"text\":\"- Evidence: [LONG_REDACTED].txt.\"},{\"line\":228,\"text\":\"- Rule: do not attempt ACL/config changes as routerbackup; use admin/operator router access or router Web UI for write changes.\"},{\"line\":232,\"text\":\"- Evidence: [LONG_REDACTED].txt has blank [LONG_REDACTED] fields.\"},{\"line\":235,\"text\":\"## [LONG_REDACTED]\"},{\"line\":236,\"text\":\"- Context: while moving Moscow Router monitor rules to _WEBADMIN_Bridge1, two _WEBADMIN_Bridge0 Nextcloud Talk TURN rules were accidentally removed.\"},{\"line\":238,\"text\":\"- Verification proof: 399_ROUTER_ACL_RESTORE_AFTER_UI_PROOF.txt.\"},{\"line\":239,\"text\":\"- Rule: after manual router Web UI ACL edits, compare _WEBADMIN_Bridge0, _WEBADMIN_Bridge1 and _WEBADMIN_GigabitEthernet1 before continuing.\"},{\"line\":241,\"text\":\"## [LONG_REDACTED]\"},{\"line\":242,\"text\":\"- Context: proof 400 tested Moscow router HTTPS monitor from Homepage container with custom Node lookup callback.\"},{\"line\":247,\"text\":\"## [LONG_REDACTED]\"},{\"line\":248,\"text\":\"- Context: Moscow Router Homepage monitor after ACL fix.\"},{\"line\":250,\"text\":\"- Observed: edge-vm TCP to [PRIVATE_IP]:5080/5083 is OK, but router HTTP/HTTPS returns 403 for all tested paths.\"},{\"line\":251,\"text\":\"- Impact: Homepage siteMonitor cannot be made green via direct router HTTP URL until router web service allows the Bridge1/Proxmox/protected segment or an explicit safe monitor endpoint is used.\"},{\"line\":255,\"text\":\"- Context: installing edge-vm Moscow router health endpoint.\"},{\"line\":261,\"text\":\"## [LONG_REDACTED]\"},{\"line\":262,\"text\":\"- Context: Moscow Router Homepage siteMonitor attempt using http://[PRIVATE_IP]:5080.\"},{\"line\":264,\"text\":\"- Impact: do not use [PRIVATE_IP] directly as Homepage siteMonitor from edge-vm.\"},{\"line\":265,\"text\":\"- Mitigation: use dedicated edge-vm health endpoint that checks router TCP [PRIVATE_IP]:5080 and returns HTTP 200/503 for Homepage.\"},{\"line\":267,\"text\":\"## [LONG_REDACTED]\"},{\"line\":268,\"text\":\"- Context: applying Moscow Router Homepage siteMonitor health endpoint.\"},{\"line\":273,\"text\":\"## [LONG_REDACTED]\"},{\"line\":274,\"text\":\"- Context: applying Moscow Router Homepage health endpoint.\"},{\"line\":276,\"text\":\"- Evidence: proof 408 showed SyntaxError in /tmp/homepage-router-moscow-apply-fixed.py.\"},{\"line\":582,\"text\":\"- Context: pvepro.ru root/www currently point to the Mailcow VPS and return Mailcow with TLS hostname mismatch.\"},{\"line\":583,\"text\":\"- Decision: because pve01 has no SSH key access to the external VPS, do not modify the VPS. Instead move only pvepro.ru and www.pvepro.ru A records to edge and serve an edge landing page.\"},{\"line\":598,\"text\":\"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router.\"},{\"line\":599,\"text\":\"- Current limitation: there is no safe private remote access path to the dacha router yet.\"},{\"line\":600,\"text\":\"- Rule: do not expose router admin publicly and do not attempt certificate deployment to the router over the public internet.\"},{\"line\":604,\"text\":\"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router.\"},{\"line\":605,\"text\":\"- Current limitation: there is no safe private remote access path to the dacha router yet.\"},{\"line\":606,\"text\":\"- Rule: do not expose router admin publicly and do not attempt certificate deployment to the router over the public internet.\"},{\"line\":610,\"text\":\"- Context: configuring private management path for taftauto.ru dacha router.\"},{\"line\":612,\"text\":\"- Rule: generated client config may be stored only as root/debian mode 600 file and must be imported into the Netcraze router UI manually.\"},{\"line\":613,\"text\":\"- Rule: do not open router public admin or certificate deployment until WireGuard handshake is proven.\"},{\"line\":626,\"text\":\"- Fix: rebuild SmartApe under External Homelabs with 2-space item indentation, remove Router Moscow, rebuild Sites category.\"},{\"line\":647,\"text\":\"## [LONG_REDACTED]\"},{\"line\":648,\"text\":\"- Previous apply looked for Russian Router card name, but active Homepage Useful group contains Router and Public Domain.\"}]\nNEWFI42_REFERENCE_RELEVANT_LINE_COUNT=50\nNEWFI42_REFERENCE_RELEVANT_LINES=[{\"line\":14,\"text\":\"- VM130 edge-vm | pve03 | running | KEEP\"},{\"line\":75,\"text\":\"NOTE edge-vm disk scsi1 backup=0 risk must be documented\"},{\"line\":90,\"text\":\"HEALTH_NOT_OK item=ingress-dns-route-slo.txt line=STATUS=WARN\"},{\"line\":149,\"text\":\"- У VM130 edge-vm есть риск: дополнительный диск backup=0.\"},{\"line\":166,\"text\":\"- VM130 edge-vm pve03 [PRIVATE_IP] Docker ingress/app host.\"},{\"line\":199,\"text\":\"## ROUTER_NETCRAZE_ULTRA_NC1812_20260630\"},{\"line\":234,\"text\":\"- WAN DHCP observed in router log: 95.84.154.183/23, gateway 95.84.154.1.\"},{\"line\":235,\"text\":\"- ISP DNS observed in router log: 77.37.251.33, 77.37.255.30.\"},{\"line\":282,\"text\":\"- Default router: [PRIVATE_IP].\"},{\"line\":312,\"text\":\"- [PRIVATE_IP] -> bc:24:11:e1:f3:3c NPMplus / edge-vm.\"},{\"line\":315,\"text\":\"### NAT / port forwarding\"},{\"line\":324,\"text\":\"- _WEBADMIN_GigabitEthernet1 permits admin PC [PRIVATE_IP] outbound TCP 80/443.\"},{\"line\":327,\"text\":\"### Router management\"},{\"line\":333,\"text\":\"- Telnet port configured: 2323, security-level private; router log shows Telnet disabled later on 2026-06-26.\"},{\"line\":339,\"text\":\"### Router services\"},{\"line\":354,\"text\":\"### Router automation warning\"},{\"line\":357,\"text\":\"- Automation must use router CLI syntax, not bash syntax.\"},{\"line\":366,\"text\":\"- edge-vm: no UPS/NUT/APCUPSD integration discovered.\"},{\"line\":371,\"text\":\"- NetBird service is active on pve01, pve02, pve03 and edge-vm.\"},{\"line\":376,\"text\":\"- edge-vm: FQDN edge-vm.netbird.selfhosted, IPv4 100.100.60.182/16.\"},{\"line\":395,\"text\":\"- edge-vm owns most application health, dashboard, ingress, backup, NetBox, NPMplus, certificate, Trivy and vulnerability jobs.\"},{\"line\":396,\"text\":\"- pve01 owns many [LONG_REDACTED] VPS/rclone/sops/scrutiny jobs.\"},{\"line\":455,\"text\":\"- edge-vm timers cover runtime dashboard, Paperless guard, external canary, health metrics, restore drill index, AdGuard rewrite sync, NPMplus cert expiry, NetBox backup/sync, retention, cluster daily status, vulnerability and Trivy scans, ingress hardening an\"},{\"line\":456,\"text\":\"- pve01 timers cover VPN/NetBird health, health metrics, smartctl, disk space, MkDocs refresh, VPS identity audit, storage capacity, quality gate, evidence catalog, backup freshness, docker health, Filebrowser backup/offhost/restore, NPMplus/Kuma backup, NetBi\"},{\"line\":459,\"text\":\"- Script hashes were captured for /usr/local/sbin and /usr/local/bin on edge-vm, pve01, pve02 and pve03.\"},{\"line\":531,\"text\":\"- Main active workload: VM130 edge-vm.\"},{\"line\":545,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":560,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":575,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":590,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":597,\"text\":\"### VM130 edge-vm\"},{\"line\":600,\"text\":\"- Name: edge-vm.\"},{\"line\":608,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":626,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":643,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":653,\"text\":\"## [LONG_REDACTED]\"},{\"line\":672,\"text\":\"- git.gram1.ru -> [PRIVATE_IP].\"},{\"line\":682,\"text\":\"### Router ingress\"},{\"line\":683,\"text\":\"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, [PRIVATE_IP].\"},{\"line\":684,\"text\":\"- Router forwards TCP/UDP 3478 to Nextcloud Talk TURN on [PRIVATE_IP].\"},{\"line\":685,\"text\":\"- Router forwards Home TCP/51820 to WireGuard host [PRIVATE_IP].\"},{\"line\":686,\"text\":\"- NPMplus admin listener is bound to localhost on edge-vm, [PRIVATE_IP]:81; public disabled legacy host npm.gram1.ru exists but enabled=0.\"},{\"line\":689,\"text\":\"- Host: edge-vm, [PRIVATE_IP].\"},{\"line\":694,\"text\":\"- Public listen ports on edge-vm: [PRIVATE_IP]:80 and [PRIVATE_IP]:443 by nginx/NPMplus.\"},{\"line\":705,\"text\":\"- git.gram1.ru -> http://[PRIVATE_IP]:3002, cert=29, ssl_forced=1, enabled=1.\"},{\"line\":754,\"text\":\"- cert=29: git.gram1.ru, expires 2026-09-13 17:36:55.\"},{\"line\":762,\"text\":\"- NPMplus schema/listen inventory: [LONG_REDACTED].txt.\"},{\"line\":769,\"text\":\"- Host: edge-vm, IP [PRIVATE_IP].\"},{\"line\":774,\"text\":\"- Public ingress terminates through NPMplus on ports 80/443.\"},{\"line\":826,\"text\":\"- Ingress/security: npmplus, socket-proxy, crowdsec.\"}]\nNEWFI42_TRUST_RELEVANT_LINE_COUNT=37\nNEWFI42_TRUST_RELEVANT_LINES=[{\"line\":1,\"text\":\"# NetBird VPS trust readiness\"},{\"line\":14,\"text\":\"public_ip=188.127.235.6\"},{\"line\":21,\"text\":\"netbird_vps_backup_ok=1\"},{\"line\":22,\"text\":\"netbird_vps_offhost_ok=1\"},{\"line\":23,\"text\":\"netbird_vps_restore_ok=1\"},{\"line\":27,\"text\":\"- Do not use public IP 188.127.235.6 until its host-key mismatch is intentionally resolved.\"},{\"line\":37,\"text\":\"--- HOST=188.127.235.6\"},{\"line\":39,\"text\":\"KNOWN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] |1|/0oIfigkDxhJFJWj72WrkRkYUqo=|29qT4RhgqPPXt3sOwBqw7QrafBY= (ECDSA)\"},{\"line\":40,\"text\":\"KNOWN_FP host=188.127.235.6 3072 SHA256:[LONG_REDACTED] |1|Hmbhg2wXCUS/SDiuLTTgk6Vxhns=|kw5S70w76UhROmk1XT92s4Z757Y= (RSA)\"},{\"line\":41,\"text\":\"KNOWN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] |1|q70vtOfl5nR+CvnLuV7OQ3aEFIo=|OJi44TxJaz3cfw57HO19UEkZc/M= (ED25519)\"},{\"line\":43,\"text\":\"KEYSCAN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] 188.127.235.6 (ED25519)\"},{\"line\":44,\"text\":\"KEYSCAN_FP host=188.127.235.6 3072 SHA256:[LONG_REDACTED] 188.127.235.6 (RSA)\"},{\"line\":45,\"text\":\"KEYSCAN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] 188.127.235.6 (ECDSA)\"},{\"line\":63,\"text\":\"REMOTE_HOSTNAME=edge-vm\"},{\"line\":71,\"text\":\"256 SHA256:[LONG_REDACTED] root@edge-vm (ED25519)\"},{\"line\":72,\"text\":\"256 SHA256:[LONG_REDACTED] root@edge-vm (ECDSA)\"},{\"line\":73,\"text\":\"3072 SHA256:[LONG_REDACTED] root@edge-vm (RSA)\"},{\"line\":77,\"text\":\"REMOTE_HOSTNAME=edge-vm\"},{\"line\":85,\"text\":\"256 SHA256:[LONG_REDACTED] root@edge-vm (ED25519)\"},{\"line\":86,\"text\":\"256 SHA256:[LONG_REDACTED] root@edge-vm (ECDSA)\"},{\"line\":87,\"text\":\"3072 SHA256:[LONG_REDACTED] root@edge-vm (RSA)\"},{\"line\":102,\"text\":\"PUBLIC_STRICT   ssh-keygen -f '[SENSITIVE_PATH] -R '188.127.235.6'\"},{\"line\":103,\"text\":\"PUBLIC_STRICT Host key for 188.127.235.6 has changed and you have requested strict checking.\"},{\"line\":107,\"text\":\"--- [LONG_REDACTED].txt\"},{\"line\":108,\"text\":\"STATUS=OK TS=2026-07-07T15:15:14Z TYPE=external-probe-vps BAD=0 WARN=0 MODE=STRATEGY_ONLY DEPLOYED=NO [LONG_REDACTED] [LONG_REDACTED] BACKUP_HOSTKEYS=no PVE01_PUBLIC_SMOKE_BAD=0 INDEPENDENT_RUNNER=missing [LONG_REDACTED].md\"},{\"line\":109,\"text\":\"--- [LONG_REDACTED].txt\"},{\"line\":111,\"text\":\"SERVICE=netbird-vps-backup\"},{\"line\":113,\"text\":\"VPS_IP=188.127.235.6\"},{\"line\":114,\"text\":\"[LONG_REDACTED]\"},{\"line\":115,\"text\":\"[LONG_REDACTED]\"},{\"line\":119,\"text\":\"--- [LONG_REDACTED].txt\"},{\"line\":121,\"text\":\"SERVICE=netbird-vps-offhost\"},{\"line\":124,\"text\":\"[LONG_REDACTED]\"},{\"line\":129,\"text\":\"--- [LONG_REDACTED].txt\"},{\"line\":131,\"text\":\"SERVICE=netbird-vps-restore-validation\"},{\"line\":134,\"text\":\"[LONG_REDACTED].tgz\"},{\"line\":153,\"text\":\"edge-vm service=active/enabled wt0_ip=100.100.60.182/16 management=yes signal=yes peers=6/9 Connected\"}]\nNEWFI42_TEXT_FILES_SCANNED=336\nNEWFI42_TOPOLOGY_MATCH_FILE_COUNT=50\nNEWFI42_TOPOLOGY_MATCH_FILES_TRUNCATED=false\nNEWFI42_TOPOLOGY_MATCH_FILES=[{\"path\":\"/etc/pve/.rrd\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/etc/pve/HOMEPAGE_BACKUP_COVERAGE_MATRIX.md.bak-corrected-20260630T185336Z\",\"tags\":[\"ROUTER\"]},{\"path\":\"/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md\",\"tags\":[\"REJECTED_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/etc/pve/HOMEPAGE_BACKUP_COVERAGE_MATRIX.md\",\"tags\":[\"ROUTER\"]},{\"path\":\"/etc/pve/31_HOMELAB_REFERENCE.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-router-cli-20260630T215229Z\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md\",\"tags\":[\"REJECTED_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak.20260721T112115Z\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/etc/pve/HOMELAB_CLUSTER_BACKLOG.md\",\"tags\":[\"EDGE_VM\",\"ROUTER\"]},{\"path\":\"/etc/pve/HOMEPAGE_BACKUP_GAP_CLASSIFICATION.md\",\"tags\":[\"ROUTER\"]},{\"path\":\"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"STAGING_HOST\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-proof-repair-20260630T215529Z\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/etc/pve/priv/authorized_keys\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\"]},{\"path\":\"/etc/pve/nodes/pve03/qemu-server/130.conf\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/var/lib/homelab-netbird-vps-trust/closure-latest.md\",\"tags\":[\"REJECTED_IP\",\"EDGE_VM\",\"NAT_FORWARD\"]},{\"path\":\"/var/lib/homelab-netbird-vps-trust/latest.md\",\"tags\":[\"REJECTED_IP\",\"EDGE_VM\"]},{\"path\":\"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md\",\"tags\":[\"REJECTED_IP\",\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/observed/cluster-guests.json\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/observed/source-snapshots/dependency-map-latest.tsv\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/inventory/access-paths.json\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/changes/CR-2026-0081/home-forward-retire-package.sha256\",\"tags\":[\"PUBLIC_80_443\"]},{\"path\":\"/srv/homelab-ops/changes/CR-2026-0018/design.md\",\"tags\":[\"NAT_FORWARD\"]},{\"path\":\"/srv/homelab-ops/changes/CR-2026-0080/task-package.sha256\",\"tags\":[\"NAT_FORWARD\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-vm150-rebuild-v2/task.json\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/skladchik-reports-monitor-controlled-reauth-v1/assets/pve01/skladchik-reports-monitor-status\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/tasks/skladchik-reports-monitor-controlled-reauth-v1/assets/pve01/skladchik-reports-monitor-monthly-selftest-watch\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/task.json\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/README.txt\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-home-restricted-ingress.nft\",\"tags\":[\"PUBLIC_IP\",\"NAT_FORWARD\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-public-ingress.nft\",\"tags\":[\"PUBLIC_IP\",\"NAT_FORWARD\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/tools/cutover.py\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/task.json\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/README.txt\",\"tags\":[\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/tools/retire_home_forwards.py\",\"tags\":[\"PUBLIC_IP\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/task.json\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/README.txt\",\"tags\":[\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/tools/retire_turn_dns.py\",\"tags\":[\"PUBLIC_IP\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-post-cutover-hardening-design.md\",\"tags\":[\"PUBLIC_IP\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/specs/2026-08-18-gitea-edge-publisher-v3-design-v1.1.md\",\"tags\":[\"NAT_FORWARD\",\"TUNNEL\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-edge-cutover-design.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-18-gitea-edge-publisher-v3.md\",\"tags\":[\"PUBLIC_IP\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-home-forward-retirement.md\",\"tags\":[\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-edge-cutover.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-turn-legacy-dns-retirement.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/kb/AI_CONTEXT.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/kb/inventory/guests.json\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\",\"TUNNEL\"]},{\"path\":\"/srv/homelab-ops/kb/runbooks/03_EDGE_NGINX.md\",\"tags\":[\"PUBLIC_IP\"]},{\"path\":\"/srv/homelab-ops/tests/test_cr_2026_0080_snikket_edge_cutover.py\",\"tags\":[\"PUBLIC_IP\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tests/test_cr_2026_0081_turn_dns_retire.py\",\"tags\":[\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tests/test_cr_2026_0081_home_forward_retire.py\",\"tags\":[\"PUBLIC_IP\",\"ROUTER\"]}]\nNEWFI42_OPS_GIT_STATUS_RC=0\nNEWFI42_OPS_GIT_STATUS_SHA256=5fbcb2990ad25e368c12219bf3ddca36e464d044e7acac16696fa8cd54159185\nNEWFI42_OPS_GIT_HEAD_RC=0\nNEWFI42_OPS_GIT_HEAD=d5e2ef5639398a762283e47143c17b494f8ed579\nNEWFI42_NETWORK_RELATED_UNIT_QUERY_RC=0\nNEWFI42_NETWORK_RELATED_UNITS=[{\"unit\":\"\\u25cf\",\"load\":\"gssproxy.service\",\"active\":\"not-found\",\"sub\":\"inactive\"},{\"unit\":\"netbird-peers-health.service\",\"load\":\"loaded\",\"active\":\"inactive\",\"sub\":\"dead\"},{\"unit\":\"netbird.service\",\"load\":\"loaded\",\"active\":\"active\",\"sub\":\"running\"},{\"unit\":\"pveproxy.service\",\"load\":\"loaded\",\"active\":\"active\",\"sub\":\"running\"},{\"unit\":\"spiceproxy.service\",\"load\":\"loaded\",\"active\":\"active\",\"sub\":\"running\"},{\"unit\":\"systemd-ask-password-wall.service\",\"load\":\"loaded\",\"active\":\"inactive\",\"sub\":\"dead\"}]\nNEWFI42_NFT_QUERY_RC=0\nNEWFI42_NFT_RELEVANT_RULE_COUNT=0\nNEWFI42_NFT_RELEVANT_LOCATIONS=[]\nNEWFI42_ROUTE_TO_PUBLIC_IP_RC=0\nNEWFI42_ROUTE_TO_PUBLIC_IP={\"dev\":\"vmbr0\",\"gateway_present\":true,\"gateway_sha256\":\"4f9da1283166a1e9f4e6bc7dd240c76aef85772177f717f92abb6e8e2bb8de90\",\"prefsrc_sha256\":\"fb345731d21c612ed2cb13088c10fd26bac959c79a7634cb55e23ee6bfb428d9\"}\nNEWFI42_DNS_A={\"newfi-staging.gram1.ru\":{\"ips\":[\"185.225.35.6\"],\"sources\":[\"getent\",\"dig\"]},\"chat.gram1.ru\":{\"ips\":[\"[PRIVATE_IP]\"],\"sources\":[\"getent\",\"dig\"]},\"git.gram1.ru\":{\"ips\":[\"[PRIVATE_IP]\"],\"sources\":[\"getent\",\"dig\"]},\"newfi.ru\":{\"ips\":[\"185.225.35.6\"],\"sources\":[\"getent\",\"dig\"]}}\nNEWFI42_DNS_STAGE_SHARES_IP_WITH_CHAT=false\nNEWFI42_DNS_STAGE_SHARES_IP_WITH_GIT=false\nNEWFI42_AUTHORITY_FORWARDING_ASSERTION_PRESENT=true\nNEWFI42_LOCAL_FORWARDING_RELATED_FILE_EVIDENCE=true\nNEWFI42_EXPLICIT_PUBLIC_IP_CONFIG_REFERENCE=true\nNEWFI42_DECISION=PUBLIC_INGRESS_CONTROL_PLANE_REFERENCE_FOUND_REVIEW_EXACT_MATCHED_PATHS_BEFORE_FIX\nNEWFI42_KNOWN_HOSTS_SHA256_AFTER=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735\nNEWFI42_KNOWN_HOSTS_UNCHANGED=true\nNEWFI42_CHANGES_MADE=false\nNEWFI42_MUTATION_SCOPE=NONE_READ_ONLY\nNEWFI42_RCA_EXECUTION=PASS\n"
+}
diff --git a/runtime/latest.txt b/runtime/latest.txt
index b33b31fd..49976ec0 100644
--- a/runtime/latest.txt
+++ b/runtime/latest.txt
@@ -1,162 +1,74 @@
 CHAT_OUTPUT_BEGIN
-COMMAND_ID=CONTEXT-AUTO-[PRIVATE_IP]701Z
+COMMAND_ID=NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-TOPOLOGY-RCA42
 STATUS=OK
 RC=0
 HOST=pve01
-COMPONENT=cluster-context
-REFERENCE_SHA[PRIVATE_IP]e5154c41cb[PRIVATE_IP]aca68090be[PRIVATE_IP]bf[PRIVATE_IP]df[PRIVATE_IP]
-ERROR_REGISTER_SHA[PRIVATE_IP]ec0f527ed3afeed[PRIVATE_IP]ee[PRIVATE_IP]bbfb[PRIVATE_IP]af4ba7ba0
+MODE=read-only
+COMPONENT=newfi-stagingedge-public-ingress-topology-rca-v6
+REFERENCE_REGISTER_CHECK=OK
+REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
+ERROR_REGISTER_CHECK=OK
+ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
+COMMAND_SHA256=8c1deae24d2c2e50bd7eca16ab18b10c78eb623b43884a033be8abcb060328de
+DUPLICATE_FAILED_COMMAND_BLOCKED=false
+EXECUTION_STARTED=true
+CHANGE_DECLARED=false
+RESULT_CONTRACT_VALID=true
+RESULT_CONTRACT_STATUS=NOT_APPLICABLE
+RESULT_CONTRACT_ERROR=NONE
+COMMAND_RC=0
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=NO_MUTATION
+SANITIZED=yes
+SECRETS_INCLUDED=no
+PRIVATE_ADDRESSES_INCLUDED=no
+RAW_EVIDENCE_SHA256=475297be47aae03d0ef913ed8d3c90d3f0eabe4b0a86b02e6cccd5e805171e4f
+SANITIZED_OUTPUT_SHA256=2740dbcc0eb7d919991be01db110d70f85f1c7ab59bcebf520b56960fa9399f9
 OUTPUT_BEGIN
-GENERATED_AT_UTC=[PRIVATE_IP]T18:17:01Z
-Cluster information
--------------------
-Name:             homelab
-Config Version:   3
-Transport:        knet
-Secure auth:      on
+ERROR_REGISTER_CHECK=OK
+REFERENCE_CHECK=OK
+AUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED
+NEWFI42_RUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d
+NEWFI42_KNOWN_HOSTS_SHA256_BEFORE=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735
+NEWFI42_TRUST_FILE_PRESENT=true
+NEWFI42_TRUST_FILE_SHA256=5ff80132df401240519f48091ed62c139183c325000ef7dd253e7f676a539b2c
+NEWFI42_TRUST_EDGEVM_MARKER=true
+NEWFI42_TRUST_REJECTED_MARKER=false
+NEWFI42_ERROR_RELEVANT_LINE_COUNT=50
+NEWFI42_ERROR_RELEVANT_LINES=[{"line":19,"text":"CHECK-8: для edge-vm использовать debian@[PRIVATE_IP] и sudo."},{"line":28,"text":"VM130 edge-vm has secondary disk backup=0 risk."},{"line":52,"text":"edge-vm: ssh debian@[PRIVATE_IP], внутри использовать sudo."},{"line":170,"text":"41. Ошибка: post-backup-pass-slo-reconciliation checked pve01 router health on edge-vm."},{"line":171,"text":"Факт: first reconciliation wrote STATUS=ERROR because router-running-config-mail-cloud.txt is on pve01, not edge-vm."},{"line":172,"text":"Fix: build reconciliation from pve01 and edge-vm health files by correct owner."},{"line":213,"text":"## ROUTER_CLI_STDIN_APPLY_FAILURE_20260630"},{"line":214,"text":"- Context: attempted Netcraze router ACL apply through SSH stdin/multiline for Homepage Moscow Router monitor fix."},{"line":215,"text":"- Evidence: [LONG_REDACTED].txt."},{"line":219,"text":"## [LONG_REDACTED]"},{"line":221,"text":"- Evidence: [LONG_REDACTED].txt showed COMMAND_COUNT=1."},{"line":224,"text":"## [LONG_REDACTED]"},{"line":225,"text":"- Context: routerbackup user can run show running-config but cannot execute configuration commands such as access-list."},{"line":226,"text":"- Evidence: [LONG_REDACTED].txt."},{"line":228,"text":"- Rule: do not attempt ACL/config changes as routerbackup; use admin/operator router access or router Web UI for write changes."},{"line":232,"text":"- Evidence: [LONG_REDACTED].txt has blank [LONG_REDACTED] fields."},{"line":235,"text":"## [LONG_REDACTED]"},{"line":236,"text":"- Context: while moving Moscow Router monitor rules to _WEBADMIN_Bridge1, two _WEBADMIN_Bridge0 Nextcloud Talk TURN rules were accidentally removed."},{"line":238,"text":"- Verification proof: 399_ROUTER_ACL_RESTORE_AFTER_UI_PROOF.txt."},{"line":239,"text":"- Rule: after manual router Web UI ACL edits, compare _WEBADMIN_Bridge0, _WEBADMIN_Bridge1 and _WEBADMIN_GigabitEthernet1 before continuing."},{"line":241,"text":"## [LONG_REDACTED]"},{"line":242,"text":"- Context: proof 400 tested Moscow router HTTPS monitor from Homepage container with custom Node lookup callback."},{"line":247,"text":"## [LONG_REDACTED]"},{"line":248,"text":"- Context: Moscow Router Homepage monitor after ACL fix."},{"line":250,"text":"- Observed: edge-vm TCP to [PRIVATE_IP]:5080/5083 is OK, but router HTTP/HTTPS returns 403 for all tested paths."},{"line":251,"text":"- Impact: Homepage siteMonitor cannot be made green via direct router HTTP URL until router web service allows the Bridge1/Proxmox/protected segment or an explicit safe monitor endpoint is used."},{"line":255,"text":"- Context: installing edge-vm Moscow router health endpoint."},{"line":261,"text":"## [LONG_REDACTED]"},{"line":262,"text":"- Context: Moscow Router Homepage siteMonitor attempt using http://[PRIVATE_IP]:5080."},{"line":264,"text":"- Impact: do not use [PRIVATE_IP] directly as Homepage siteMonitor from edge-vm."},{"line":265,"text":"- Mitigation: use dedicated edge-vm health endpoint that checks router TCP [PRIVATE_IP]:5080 and returns HTTP 200/503 for Homepage."},{"line":267,"text":"## [LONG_REDACTED]"},{"line":268,"text":"- Context: applying Moscow Router Homepage siteMonitor health endpoint."},{"line":273,"text":"## [LONG_REDACTED]"},{"line":274,"text":"- Context: applying Moscow Router Homepage health endpoint."},{"line":276,"text":"- Evidence: proof 408 showed SyntaxError in /tmp/homepage-router-moscow-apply-fixed.py."},{"line":582,"text":"- Context: pvepro.ru root/www currently point to the Mailcow VPS and return Mailcow with TLS hostname mismatch."},{"line":583,"text":"- Decision: because pve01 has no SSH key access to the external VPS, do not modify the VPS. Instead move only pvepro.ru and www.pvepro.ru A records to edge and serve an edge landing page."},{"line":598,"text":"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router."},{"line":599,"text":"- Current limitation: there is no safe private remote access path to the dacha router yet."},{"line":600,"text":"- Rule: do not expose router admin publicly and do not attempt certificate deployment to the router over the public internet."},{"line":604,"text":"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router."},{"line":605,"text":"- Current limitation: there is no safe private remote access path to the dacha router yet."},{"line":606,"text":"- Rule: do not expose router admin publicly and do not attempt certificate deployment to the router over the public internet."},{"line":610,"text":"- Context: configuring private management path for taftauto.ru dacha router."},{"line":612,"text":"- Rule: generated client config may be stored only as root/debian mode 600 file and must be imported into the Netcraze router UI manually."},{"line":613,"text":"- Rule: do not open router public admin or certificate deployment until WireGuard handshake is proven."},{"line":626,"text":"- Fix: rebuild SmartApe under External Homelabs with 2-space item indentation, remove Router Moscow, rebuild Sites category."},{"line":647,"text":"## [LONG_REDACTED]"},{"line":648,"text":"- Previous apply looked for Russian Router card name, but active Homepage Useful group contains Router and Public Domain."}]
+NEWFI42_REFERENCE_RELEVANT_LINE_COUNT=50
+NEWFI42_REFERENCE_RELEVANT_LINES=[{"line":14,"text":"- VM130 edge-vm | pve03 | running | KEEP"},{"line":75,"text":"NOTE edge-vm disk scsi1 backup=0 risk must be documented"},{"line":90,"text":"HEALTH_NOT_OK item=ingress-dns-route-slo.txt line=STATUS=WARN"},{"line":149,"text":"- У VM130 edge-vm есть риск: дополнительный диск backup=0."},{"line":166,"text":"- VM130 edge-vm pve03 [PRIVATE_IP] Docker ingress/app host."},{"line":199,"text":"## ROUTER_NETCRAZE_ULTRA_NC1812_20260630"},{"line":234,"text":"- WAN DHCP observed in router log: 95.84.154.183/23, gateway 95.84.154.1."},{"line":235,"text":"- ISP DNS observed in router log: 77.37.251.33, 77.37.255.30."},{"line":282,"text":"- Default router: [PRIVATE_IP]."},{"line":312,"text":"- [PRIVATE_IP] -> bc:24:11:e1:f3:3c NPMplus / edge-vm."},{"line":315,"text":"### NAT / port forwarding"},{"line":324,"text":"- _WEBADMIN_GigabitEthernet1 permits admin PC [PRIVATE_IP] outbound TCP 80/443."},{"line":327,"text":"### Router management"},{"line":333,"text":"- Telnet port configured: 2323, security-level private; router log shows Telnet disabled later on 2026-06-26."},{"line":339,"text":"### Router services"},{"line":354,"text":"### Router automation warning"},{"line":357,"text":"- Automation must use router CLI syntax, not bash syntax."},{"line":366,"text":"- edge-vm: no UPS/NUT/APCUPSD integration discovered."},{"line":371,"text":"- NetBird service is active on pve01, pve02, pve03 and edge-vm."},{"line":376,"text":"- edge-vm: FQDN edge-vm.netbird.selfhosted, IPv4 100.100.60.182/16."},{"line":395,"text":"- edge-vm owns most application health, dashboard, ingress, backup, NetBox, NPMplus, certificate, Trivy and vulnerability jobs."},{"line":396,"text":"- pve01 owns many [LONG_REDACTED] VPS/rclone/sops/scrutiny jobs."},{"line":455,"text":"- edge-vm timers cover runtime dashboard, Paperless guard, external canary, health metrics, restore drill index, AdGuard rewrite sync, NPMplus cert expiry, NetBox backup/sync, retention, cluster daily status, vulnerability and Trivy scans, ingress hardening an"},{"line":456,"text":"- pve01 timers cover VPN/NetBird health, health metrics, smartctl, disk space, MkDocs refresh, VPS identity audit, storage capacity, quality gate, evidence catalog, backup freshness, docker health, Filebrowser backup/offhost/restore, NPMplus/Kuma backup, NetBi"},{"line":459,"text":"- Script hashes were captured for /usr/local/sbin and /usr/local/bin on edge-vm, pve01, pve02 and pve03."},{"line":531,"text":"- Main active workload: VM130 edge-vm."},{"line":545,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":560,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":575,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":590,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":597,"text":"### VM130 edge-vm"},{"line":600,"text":"- Name: edge-vm."},{"line":608,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":626,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":643,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":653,"text":"## [LONG_REDACTED]"},{"line":672,"text":"- git.gram1.ru -> [PRIVATE_IP]."},{"line":682,"text":"### Router ingress"},{"line":683,"text":"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, [PRIVATE_IP]."},{"line":684,"text":"- Router forwards TCP/UDP 3478 to Nextcloud Talk TURN on [PRIVATE_IP]."},{"line":685,"text":"- Router forwards Home TCP/51820 to WireGuard host [PRIVATE_IP]."},{"line":686,"text":"- NPMplus admin listener is bound to localhost on edge-vm, [PRIVATE_IP]:81; public disabled legacy host npm.gram1.ru exists but enabled=0."},{"line":689,"text":"- Host: edge-vm, [PRIVATE_IP]."},{"line":694,"text":"- Public listen ports on edge-vm: [PRIVATE_IP]:80 and [PRIVATE_IP]:443 by nginx/NPMplus."},{"line":705,"text":"- git.gram1.ru -> http://[PRIVATE_IP]:3002, cert=29, ssl_forced=1, enabled=1."},{"line":754,"text":"- cert=29: git.gram1.ru, expires 2026-09-13 17:36:55."},{"line":762,"text":"- NPMplus schema/listen inventory: [LONG_REDACTED].txt."},{"line":769,"text":"- Host: edge-vm, IP [PRIVATE_IP]."},{"line":774,"text":"- Public ingress terminates through NPMplus on ports 80/443."},{"line":826,"text":"- Ingress/security: npmplus, socket-proxy, crowdsec."}]
+NEWFI42_TRUST_RELEVANT_LINE_COUNT=37
+NEWFI42_TRUST_RELEVANT_LINES=[{"line":1,"text":"# NetBird VPS trust readiness"},{"line":14,"text":"public_ip=188.127.235.6"},{"line":21,"text":"netbird_vps_backup_ok=1"},{"line":22,"text":"netbird_vps_offhost_ok=1"},{"line":23,"text":"netbird_vps_restore_ok=1"},{"line":27,"text":"- Do not use public IP 188.127.235.6 until its host-key mismatch is intentionally resolved."},{"line":37,"text":"--- HOST=188.127.235.6"},{"line":39,"text":"KNOWN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] |1|/0oIfigkDxhJFJWj72WrkRkYUqo=|29qT4RhgqPPXt3sOwBqw7QrafBY= (ECDSA)"},{"line":40,"text":"KNOWN_FP host=188.127.235.6 3072 SHA256:[LONG_REDACTED] |1|Hmbhg2wXCUS/SDiuLTTgk6Vxhns=|kw5S70w76UhROmk1XT92s4Z757Y= (RSA)"},{"line":41,"text":"KNOWN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] |1|q70vtOfl5nR+CvnLuV7OQ3aEFIo=|OJi44TxJaz3cfw57HO19UEkZc/M= (ED25519)"},{"line":43,"text":"KEYSCAN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] 188.127.235.6 (ED25519)"},{"line":44,"text":"KEYSCAN_FP host=188.127.235.6 3072 SHA256:[LONG_REDACTED] 188.127.235.6 (RSA)"},{"line":45,"text":"KEYSCAN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] 188.127.235.6 (ECDSA)"},{"line":63,"text":"REMOTE_HOSTNAME=edge-vm"},{"line":71,"text":"256 SHA256:[LONG_REDACTED] root@edge-vm (ED25519)"},{"line":72,"text":"256 SHA256:[LONG_REDACTED] root@edge-vm (ECDSA)"},{"line":73,"text":"3072 SHA256:[LONG_REDACTED] root@edge-vm (RSA)"},{"line":77,"text":"REMOTE_HOSTNAME=edge-vm"},{"line":85,"text":"256 SHA256:[LONG_REDACTED] root@edge-vm (ED25519)"},{"line":86,"text":"256 SHA256:[LONG_REDACTED] root@edge-vm (ECDSA)"},{"line":87,"text":"3072 SHA256:[LONG_REDACTED] root@edge-vm (RSA)"},{"line":102,"text":"PUBLIC_STRICT   ssh-keygen -f '[SENSITIVE_PATH] -R '188.127.235.6'"},{"line":103,"text":"PUBLIC_STRICT Host key for 188.127.235.6 has changed and you have requested strict checking."},{"line":107,"text":"--- [LONG_REDACTED].txt"},{"line":108,"text":"STATUS=OK TS=2026-07-07T15:15:14Z TYPE=external-probe-vps BAD=0 WARN=0 MODE=STRATEGY_ONLY DEPLOYED=NO [LONG_REDACTED] [LONG_REDACTED] BACKUP_HOSTKEYS=no PVE01_PUBLIC_SMOKE_BAD=0 INDEPENDENT_RUNNER=missing [LONG_REDACTED].md"},{"line":109,"text":"--- [LONG_REDACTED].txt"},{"line":111,"text":"SERVICE=netbird-vps-backup"},{"line":113,"text":"VPS_IP=188.127.235.6"},{"line":114,"text":"[LONG_REDACTED]"},{"line":115,"text":"[LONG_REDACTED]"},{"line":119,"text":"--- [LONG_REDACTED].txt"},{"line":121,"text":"SERVICE=netbird-vps-offhost"},{"line":124,"text":"[LONG_REDACTED]"},{"line":129,"text":"--- [LONG_REDACTED].txt"},{"line":131,"text":"SERVICE=netbird-vps-restore-validation"},{"line":134,"text":"[LONG_REDACTED].tgz"},{"line":153,"text":"edge-vm service=active/enabled wt0_ip=100.100.60.182/16 management=yes signal=yes peers=6/9 Connected"}]
+NEWFI42_TEXT_FILES_SCANNED=336
+NEWFI42_TOPOLOGY_MATCH_FILE_COUNT=50
+NEWFI42_TOPOLOGY_MATCH_FILES_TRUNCATED=false
+NEWFI42_TOPOLOGY_MATCH_FILES=[{"path":"/etc/pve/.rrd","tags":["EDGE_VM"]},{"path":"/etc/pve/HOMEPAGE_BACKUP_COVERAGE_MATRIX.md.bak-corrected-20260630T185336Z","tags":["ROUTER"]},{"path":"/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","tags":["REJECTED_IP","EDGE_VM","PUBLIC_80_443","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/etc/pve/HOMEPAGE_BACKUP_COVERAGE_MATRIX.md","tags":["ROUTER"]},{"path":"/etc/pve/31_HOMELAB_REFERENCE.md","tags":["PUBLIC_IP","EDGE_VM","PUBLIC_80_443","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-router-cli-20260630T215229Z","tags":["EDGE_VM","NAT_FORWARD","ROUTER"]},{"path":"/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md","tags":["REJECTED_IP","EDGE_VM","PUBLIC_80_443","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak.20260721T112115Z","tags":["EDGE_VM","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/etc/pve/HOMELAB_CLUSTER_BACKLOG.md","tags":["EDGE_VM","ROUTER"]},{"path":"/etc/pve/HOMEPAGE_BACKUP_GAP_CLASSIFICATION.md","tags":["ROUTER"]},{"path":"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md","tags":["PUBLIC_IP","EDGE_VM","STAGING_HOST","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-proof-repair-20260630T215529Z","tags":["EDGE_VM","NAT_FORWARD","ROUTER"]},{"path":"/etc/pve/priv/authorized_keys","tags":["EDGE_VM","NAT_FORWARD"]},{"path":"/etc/pve/nodes/pve03/qemu-server/130.conf","tags":["EDGE_VM"]},{"path":"/var/lib/homelab-netbird-vps-trust/closure-latest.md","tags":["REJECTED_IP","EDGE_VM","NAT_FORWARD"]},{"path":"/var/lib/homelab-netbird-vps-trust/latest.md","tags":["REJECTED_IP","EDGE_VM"]},{"path":"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md","tags":["REJECTED_IP","EDGE_VM"]},{"path":"/srv/homelab-ops/observed/cluster-guests.json","tags":["EDGE_VM"]},{"path":"/srv/homelab-ops/observed/source-snapshots/dependency-map-latest.tsv","tags":["EDGE_VM"]},{"path":"/srv/homelab-ops/inventory/access-paths.json","tags":["EDGE_VM"]},{"path":"/srv/homelab-ops/changes/CR-2026-0081/home-forward-retire-package.sha256","tags":["PUBLIC_80_443"]},{"path":"/srv/homelab-ops/changes/CR-2026-0018/design.md","tags":["NAT_FORWARD"]},{"path":"/srv/homelab-ops/changes/CR-2026-0080/task-package.sha256","tags":["NAT_FORWARD"]},{"path":"/srv/homelab-ops/tasks/snikket-vm150-rebuild-v2/task.json","tags":["EDGE_VM","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/tasks/skladchik-reports-monitor-controlled-reauth-v1/assets/pve01/skladchik-reports-monitor-status","tags":["EDGE_VM"]},{"path":"/srv/homelab-ops/tasks/skladchik-reports-monitor-controlled-reauth-v1/assets/pve01/skladchik-reports-monitor-monthly-selftest-watch","tags":["EDGE_VM"]},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/task.json","tags":["PUBLIC_IP","EDGE_VM","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/README.txt","tags":["PUBLIC_IP","EDGE_VM","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-home-restricted-ingress.nft","tags":["PUBLIC_IP","NAT_FORWARD"]},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-public-ingress.nft","tags":["PUBLIC_IP","NAT_FORWARD"]},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/tools/cutover.py","tags":["PUBLIC_IP","EDGE_VM","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/task.json","tags":["PUBLIC_IP","EDGE_VM","PUBLIC_80_443","ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/README.txt","tags":["ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/tools/retire_home_forwards.py","tags":["PUBLIC_IP","ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/task.json","tags":["PUBLIC_IP","EDGE_VM","ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/README.txt","tags":["ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/tools/retire_turn_dns.py","tags":["PUBLIC_IP"]},{"path":"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-post-cutover-hardening-design.md","tags":["PUBLIC_IP","ROUTER"]},{"path":"/srv/homelab-ops/docs/superpowers/specs/2026-08-18-gitea-edge-publisher-v3-design-v1.1.md","tags":["NAT_FORWARD","TUNNEL"]},{"path":"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-edge-cutover-design.md","tags":["PUBLIC_IP","EDGE_VM","PUBLIC_80_443","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-18-gitea-edge-publisher-v3.md","tags":["PUBLIC_IP"]},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-home-forward-retirement.md","tags":["PUBLIC_80_443","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-edge-cutover.md","tags":["PUBLIC_IP","EDGE_VM","PUBLIC_80_443","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-turn-legacy-dns-retirement.md","tags":["PUBLIC_IP","EDGE_VM","ROUTER"]},{"path":"/srv/homelab-ops/kb/AI_CONTEXT.md","tags":["PUBLIC_IP","EDGE_VM"]},{"path":"/srv/homelab-ops/kb/inventory/guests.json","tags":["EDGE_VM","NAT_FORWARD","TUNNEL"]},{"path":"/srv/homelab-ops/kb/runbooks/03_EDGE_NGINX.md","tags":["PUBLIC_IP"]},{"path":"/srv/homelab-ops/tests/test_cr_2026_0080_snikket_edge_cutover.py","tags":["PUBLIC_IP","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/tests/test_cr_2026_0081_turn_dns_retire.py","tags":["ROUTER"]},{"path":"/srv/homelab-ops/tests/test_cr_2026_0081_home_forward_retire.py","tags":["PUBLIC_IP","ROUTER"]}]
+NEWFI42_OPS_GIT_STATUS_RC=0
+NEWFI42_OPS_GIT_STATUS_SHA256=5fbcb2990ad25e368c12219bf3ddca36e464d044e7acac16696fa8cd54159185
+NEWFI42_OPS_GIT_HEAD_RC=0
+NEWFI42_OPS_GIT_HEAD=d5e2ef5639398a762283e47143c17b494f8ed579
+NEWFI42_NETWORK_RELATED_UNIT_QUERY_RC=0
+NEWFI42_NETWORK_RELATED_UNITS=[{"unit":"\u25cf","load":"gssproxy.service","active":"not-found","sub":"inactive"},{"unit":"netbird-peers-health.service","load":"loaded","active":"inactive","sub":"dead"},{"unit":"netbird.service","load":"loaded","active":"active","sub":"running"},{"unit":"pveproxy.service","load":"loaded","active":"active","sub":"running"},{"unit":"spiceproxy.service","load":"loaded","active":"active","sub":"running"},{"unit":"systemd-ask-password-wall.service","load":"loaded","active":"inactive","sub":"dead"}]
+NEWFI42_NFT_QUERY_RC=0
+NEWFI42_NFT_RELEVANT_RULE_COUNT=0
+NEWFI42_NFT_RELEVANT_LOCATIONS=[]
+NEWFI42_ROUTE_TO_PUBLIC_IP_RC=0
+NEWFI42_ROUTE_TO_PUBLIC_IP={"dev":"vmbr0","gateway_present":true,"gateway_sha256":"4f9da1283166a1e9f4e6bc7dd240c76aef85772177f717f92abb6e8e2bb8de90","prefsrc_sha256":"fb345731d21c612ed2cb13088c10fd26bac959c79a7634cb55e23ee6bfb428d9"}
+NEWFI42_DNS_A={"newfi-staging.gram1.ru":{"ips":["185.225.35.6"],"sources":["getent","dig"]},"chat.gram1.ru":{"ips":["[PRIVATE_IP]"],"sources":["getent","dig"]},"git.gram1.ru":{"ips":["[PRIVATE_IP]"],"sources":["getent","dig"]},"newfi.ru":{"ips":["185.225.35.6"],"sources":["getent","dig"]}}
+NEWFI42_DNS_STAGE_SHARES_IP_WITH_CHAT=false
+NEWFI42_DNS_STAGE_SHARES_IP_WITH_GIT=false
+NEWFI42_AUTHORITY_FORWARDING_ASSERTION_PRESENT=true
+NEWFI42_LOCAL_FORWARDING_RELATED_FILE_EVIDENCE=true
+NEWFI42_EXPLICIT_PUBLIC_IP_CONFIG_REFERENCE=true
+NEWFI42_DECISION=PUBLIC_INGRESS_CONTROL_PLANE_REFERENCE_FOUND_REVIEW_EXACT_MATCHED_PATHS_BEFORE_FIX
+NEWFI42_KNOWN_HOSTS_SHA256_AFTER=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735
+NEWFI42_KNOWN_HOSTS_UNCHANGED=true
+NEWFI42_CHANGES_MADE=false
+NEWFI42_MUTATION_SCOPE=NONE_READ_ONLY
+NEWFI42_RCA_EXECUTION=PASS
 
-Quorum information
-------------------
-Date:             Tue Sep  [PRIVATE_IP] 2026
-Quorum provider:  corosync_votequorum
-Nodes:            3
-Node ID:          [PRIVATE_IP]
-Ring ID:          1.130
-Quorate:          Yes
-
-Votequorum information
-----------------------
-Expected votes:   3
-Highest expected: 3
-Total votes:      3
-Quorum:           2  
-Flags:            Quorate 
-
-Membership information
-----------------------
-    Nodeid      Votes Name
-[PRIVATE_IP]          [PRIVATE_IP].11 (local)
-[PRIVATE_IP]          [PRIVATE_IP].13
-[PRIVATE_IP]          [PRIVATE_IP].12
-
-Membership information
-----------------------
-    Nodeid      Votes Name
-         1          1 pve01 (local)
-         2          1 pve03
-         3          1 pve02
-[{"cpu":[PRIVATE_IP]013208,"disk":[PRIVATE_IP],"diskread":[PRIVATE_IP],"diskwrite":[PRIVATE_IP],"id":"lxc/110","maxcpu":1,"maxdisk":[PRIVATE_IP],"maxmem":[PRIVATE_IP],"mem":[PRIVATE_IP],"memhost":0,"name":"dns1","netin":[PRIVATE_IP],"netout":[PRIVATE_IP],"node":"pve01","status":"running","template":0,"type":"lxc","uptime":967499,"vmid":110},{"cpu":[PRIVATE_IP]222073,"disk":[PRIVATE_IP],"diskread":[PRIVATE_IP],"diskwrite":[PRIVATE_IP],"id":"lxc/111","maxcpu":1,"maxdisk":[PRIVATE_IP],"maxmem":[PRIVATE_IP],"mem":[PRIVATE_IP],"memhost":0,"name":"dns2","netin":[PRIVATE_IP],"netout":[PRIVATE_IP],"node":"pve02","status":"running","template":0,"type":"lxc","uptime":967488,"vmid":111},{"cpu":[PRIVATE_IP]623e-05,"disk":[PRIVATE_IP],"diskread":[PRIVATE_IP],"diskwrite":[PRIVATE_IP],"id":"lxc/112","maxcpu":1,"maxdisk":[PRIVATE_IP],"maxmem":[PRIVATE_IP],"mem":[PRIVATE_IP],"memhost":0,"name":"unbound1","netin":[PRIVATE_IP],"netout":[PRIVATE_IP],"node":"pve01","status":"running","template":0,"type":"lxc","uptime":967502,"vmid":112},{"cpu":0,"disk":[PRIVATE_IP],"diskread":[PRIVATE_IP],"diskwrite":[PRIVATE_IP],"id":"lxc/113","maxcpu":1,"maxdisk":[PRIVATE_IP],"maxmem":[PRIVATE_IP],"mem":[PRIVATE_IP],"memhost":0,"name":"unbound2","netin":[PRIVATE_IP],"netout":[PRIVATE_IP],"node":"pve02","status":"running","template":0,"type":"lxc","uptime":967491,"vmid":113},{"cpu":[PRIVATE_IP]04836,"disk":0,"diskread":[PRIVATE_IP],"diskwrite":[PRIVATE_IP],"id":"qemu/130","maxcpu":4,"maxdisk":[PRIVATE_IP],"maxmem":[PRIVATE_IP],"mem":[PRIVATE_IP],"memhost":[PRIVATE_IP],"name":"edge-vm","netin":[PRIVATE_IP],"netout":[PRIVATE_IP],"node":"pve03","status":"running","template":0,"type":"qemu","uptime":967366,"vmid":130},{"cpu":[PRIVATE_IP]017806,"disk":0,"diskread":[PRIVATE_IP],"diskwrite":[PRIVATE_IP],"id":"qemu/150","maxcpu":4,"maxdisk":[PRIVATE_IP],"maxmem":[PRIVATE_IP],"mem":[PRIVATE_IP],"memhost":[PRIVATE_IP],"name":"snikket","netin":[PRIVATE_IP],"netout":[PRIVATE_IP],"node":"pve01","status":"running","template":0,"type":"qemu","uptime":967489,"vmid":150},{"cpu":[PRIVATE_IP]965803,"disk":0,"diskread":[PRIVATE_IP],"diskwrite":[PRIVATE_IP],"id":"qemu/160","maxcpu":4,"maxdisk":[PRIVATE_IP],"maxmem":[PRIVATE_IP],"mem":[PRIVATE_IP],"memhost":[PRIVATE_IP],"name":"forum-prod","netin":[PRIVATE_IP],"netout":[PRIVATE_IP],"node":"pve02","status":"running","template":0,"type":"qemu","uptime":967485,"vmid":160},{"cpu":[PRIVATE_IP]66993,"disk":0,"diskread":[PRIVATE_IP],"diskwrite":[PRIVATE_IP],"id":"qemu/170","maxcpu":4,"maxdisk":[PRIVATE_IP],"maxmem":[PRIVATE_IP],"mem":[PRIVATE_IP],"memhost":[PRIVATE_IP],"name":"core-apps","netin":[PRIVATE_IP],"netout":[PRIVATE_IP],"node":"pve01","status":"running","template":0,"type":"qemu","uptime":967496,"vmid":170},{"cpu":[PRIVATE_IP]14839,"disk":0,"diskread":[PRIVATE_IP],"diskwrite":[PRIVATE_IP],"id":"qemu/171","maxcpu":4,"maxdisk":[PRIVATE_IP],"maxmem":[PRIVATE_IP],"mem":[PRIVATE_IP],"memhost":[PRIVATE_IP],"name":"monitoring","netin":[PRIVATE_IP],"netout":[PRIVATE_IP],"node":"pve01","status":"running","template":0,"type":"qemu","uptime":967493,"vmid":171},{"cpu":[PRIVATE_IP]378627,"disk":0,"diskread":[PRIVATE_IP],"diskwrite":[PRIVATE_IP],"id":"qemu/190","maxcpu":4,"maxdisk":[PRIVATE_IP],"maxmem":[PRIVATE_IP],"mem":[PRIVATE_IP],"memhost":[PRIVATE_IP],"name":"homelab-ops-worker","netin":[PRIVATE_IP],"netout":[PRIVATE_IP],"node":"pve03","status":"running","template":0,"type":"qemu","uptime":967362,"vmid":190},{"cpu":[PRIVATE_IP]017806,"disk":0,"diskread":[PRIVATE_IP],"diskwrite":[PRIVATE_IP],"id":"qemu/210","maxcpu":2,"maxdisk":[PRIVATE_IP],"maxmem":[PRIVATE_IP],"mem":[PRIVATE_IP],"memhost":[PRIVATE_IP],"name":"newfi-prod","netin":[PRIVATE_IP],"netout":[PRIVATE_IP],"node":"pve01","status":"running","template":0,"type":"qemu","uptime":155963,"vmid":210},{"cpu":[PRIVATE_IP]841394,"disk":0,"diskread":[PRIVATE_IP],"diskwrite":[PRIVATE_IP],"id":"qemu/211","maxcpu":2,"maxdisk":[PRIVATE_IP],"maxmem":[PRIVATE_IP],"mem":[PRIVATE_IP],"memhost":[PRIVATE_IP],"name":"newfi-staging","netin":[PRIVATE_IP],"netout":[PRIVATE_IP],"node":"pve03","status":"running","template":0,"type":"qemu","uptime":351890,"vmid":211},{"cpu":0,"disk":0,"diskread":0,"diskwrite":0,"id":"qemu/9130","maxcpu":4,"maxdisk":[PRIVATE_IP],"maxmem":[PRIVATE_IP],"mem":0,"memhost":0,"name":"edge-cold-standby","netin":0,"netout":0,"node":"pve02","status":"stopped","template":0,"type":"qemu","uptime":0,"vmid":9130},{"cgroup-mode":2,"cpu":[PRIVATE_IP]40612,"disk":[PRIVATE_IP],"id":"node/pve02","level":"","maxcpu":4,"maxdisk":[PRIVATE_IP],"maxmem":[PRIVATE_IP],"mem":[PRIVATE_IP],"node":"pve02","status":"online","type":"node","uptime":967515},{"cgroup-mode":2,"cpu":[PRIVATE_IP]71134,"disk":[PRIVATE_IP],"id":"node/pve01","level":"","maxcpu":24,"maxdisk":[PRIVATE_IP],"maxmem":[PRIVATE_IP],"mem":[PRIVATE_IP],"node":"pve01","status":"online","type":"node","uptime":967525},{"cgroup-mode":2,"cpu":[PRIVATE_IP]58463,"disk":[PRIVATE_IP],"id":"node/pve03","level":"","maxcpu":8,"maxdisk":[PRIVATE_IP],"maxmem":[PRIVATE_IP],"mem":[PRIVATE_IP],"node":"pve03","status":"online","type":"node","uptime":967384},{"content":"images,rootdir","disk":[PRIVATE_IP],"id":"storage/pve02/local-lvm","maxdisk":[PRIVATE_IP],"node":"pve02","plugintype":"lvmthin","shared":0,"status":"available","storage":"local-lvm","type":"storage"},{"content":"images,rootdir","disk":[PRIVATE_IP],"id":"storage/pve01/local-lvm","maxdisk":[PRIVATE_IP],"node":"pve01","plugintype":"lvmthin","shared":0,"status":"available","storage":"local-lvm","type":"storage"},{"content":"images,rootdir","disk":[PRIVATE_IP],"id":"storage/pve03/local-lvm","maxdisk":[PRIVATE_IP],"node":"pve03","plugintype":"lvmthin","shared":0,"status":"available","storage":"local-lvm","type":"storage"},{"content":"iso,backup,vztmpl,import","disk":[PRIVATE_IP],"id":"storage/pve02/local","maxdisk":[PRIVATE_IP],"node":"pve02","plugintype":"dir","shared":0,"status":"available","storage":"local","type":"storage"},{"content":"iso,backup,vztmpl,import","disk":[PRIVATE_IP],"id":"storage/pve01/local","maxdisk":[PRIVATE_IP],"node":"pve01","plugintype":"dir","shared":0,"status":"available","storage":"local","type":"storage"},{"content":"iso,backup,vztmpl,import","disk":[PRIVATE_IP],"id":"storage/pve03/local","maxdisk":[PRIVATE_IP],"node":"pve03","plugintype":"dir","shared":0,"status":"available","storage":"local","type":"storage"},{"id":"network/pve02/zone/localnetwork","network":"localnetwork","network-type":"zone","node":"pve02","status":"ok","type":"network"},{"id":"network/pve01/zone/localnetwork","network":"localnetwork","network-type":"zone","node":"pve01","status":"ok","type":"network"},{"id":"network/pve03/zone/localnetwork","network":"localnetwork","network-type":"zone","node":"pve03","status":"ok","type":"network"}]
-Name             Type     Status     Total (KiB)      Used (KiB) Available (KiB)        %
-local             dir     active       [PRIVATE_IP]        [PRIVATE_IP]        [PRIVATE_IP]   20.53%
-local-lvm     lvmthin     active       [PRIVATE_IP]        [PRIVATE_IP]       [PRIVATE_IP]    9.35%
-  UNIT                                LOAD   ACTIVE SUB    DESCRIPTION
-● homelab-backup-retention-gc.service loaded failed failed Homelab owner-aware cloud retention GC
-
-Legend: LOAD   → Reflects whether the unit definition was properly loaded.
-        ACTIVE → The high-level unit activation state, i.e. generalization of SUB.
-        SUB    → The low-level unit activation state, values depend on unit type.
-
-1 loaded units listed.
-NEXT                            LEFT LAST                               PASSED UNIT                                                   ACTIVATES
-Tue [PRIVATE_IP] 21:17:08 MSK       6s Tue [PRIVATE_IP] 21:11:54 MSK      5min ago homelab-health-metrics.timer                           homelab-health-metrics.service
-Tue [PRIVATE_IP] 21:17:54 MSK      51s Tue [PRIVATE_IP] 21:02:54 MSK     14min ago homelab-pve03-staging-capacity-health.timer            homelab-pve03-staging-capacity-health.service
-Tue [PRIVATE_IP] 21:17:54 MSK      51s Tue [PRIVATE_IP] 21:16:54 MSK        8s ago homelab-private-vpn-hosts-health.timer                 homelab-private-vpn-hosts-health.service
-Tue [PRIVATE_IP] 21:17:54 MSK      51s Tue [PRIVATE_IP] 21:07:54 MSK      9min ago skladchik-reports-monitor-supervisor.timer             skladchik-reports-monitor-supervisor.service
-Tue [PRIVATE_IP] 21:17:54 MSK      52s Tue [PRIVATE_IP] 21:16:54 MSK        8s ago homelab-router-watchdog.timer                          homelab-router-watchdog.service
-Tue [PRIVATE_IP] 21:20:54 MSK 3min 51s Tue [PRIVATE_IP] 21:15:54 MSK   1min 8s ago homelab-smartctl-textfile.timer                        homelab-smartctl-textfile.service
-Tue [PRIVATE_IP] 21:20:54 MSK 3min 51s Tue [PRIVATE_IP] 21:15:54 MSK   1min 8s ago netbird-peers-health.timer                             netbird-peers-health.service
-Tue [PRIVATE_IP] 21:22:54 MSK     5min Tue [PRIVATE_IP] 21:07:54 MSK      9min ago prometheus-node-exporter-apt.timer                     prometheus-node-exporter-apt.service
-Tue [PRIVATE_IP] 21:24:16 MSK     7min Tue [PRIVATE_IP] 21:09:16 MSK      7min ago prometheus-node-exporter-nvme.timer                    prometheus-node-exporter-nvme.service
-Tue [PRIVATE_IP] 21:27:22 MSK    10min Tue [PRIVATE_IP] 20:53:57 MSK     23min ago homelab-reference-refresh.timer                        homelab-reference-refresh.service
-Tue [PRIVATE_IP] 21:29:42 MSK    12min Tue [PRIVATE_IP] 21:14:42 MSK  2min 20s ago homelab-disk-space-health.timer                        homelab-disk-space-health.service
-Tue [PRIVATE_IP] 21:30:00 MSK    12min Tue [PRIVATE_IP] 19:30:07 MSK  1h 46min ago homelab-app-cloud-quorum-queue.timer                   homelab-app-cloud-quorum-queue.service
-Tue [PRIVATE_IP] 21:30:00 MSK    12min Tue [PRIVATE_IP] 21:15:07 MSK  1min 54s ago homelab-incident-journal.timer                         homelab-incident-journal.service
-Tue [PRIVATE_IP] 21:30:13 MSK    13min Tue [PRIVATE_IP] 21:01:12 MSK     15min ago homelab-mkdocs-auto-refresh.timer                      homelab-mkdocs-auto-refresh.service
-Tue [PRIVATE_IP] 21:30:21 MSK    13min Tue [PRIVATE_IP] 21:15:32 MSK  1min 30s ago homelab-forum-snuffleupagus-health.timer               homelab-forum-snuffleupagus-health.service
-Tue [PRIVATE_IP] 21:30:26 MSK    13min Tue [PRIVATE_IP] 21:16:16 MSK       46s ago homelab-duty-admin-v2.timer                            homelab-duty-admin-v2.service
-Tue [PRIVATE_IP] 21:30:29 MSK    13min Tue [PRIVATE_IP] 21:15:16 MSK  1min 46s ago homelab-external-probe-vps-health.timer                homelab-external-probe-vps-health.service
-Tue [PRIVATE_IP] 21:36:50 MSK    19min Tue [PRIVATE_IP] 21:05:54 MSK     11min ago homelab-backup-audit.timer                             homelab-backup-audit.service
-Tue [PRIVATE_IP] 22:01:34 MSK    44min Tue [PRIVATE_IP] 21:04:07 MSK     12min ago homelab-control-backup.timer                           homelab-control-backup.service
-Tue [PRIVATE_IP] 22:35:54 MSK 1h 18min Tue [PRIVATE_IP] 16:35:54 MSK  4h 41min ago homelab-vps-identity-audit.timer                       homelab-vps-identity-audit.service
-Tue [PRIVATE_IP] 22:54:10 MSK 1h 37min Tue [PRIVATE_IP] 16:49:37 MSK  4h 27min ago homelab-evidence-root.timer                            homelab-evidence-root.service
-Wed [PRIVATE_IP] 00:00:00 MSK 2h 42min Tue [PRIVATE_IP] 00:00:07 MSK       21h ago dpkg-db-backup.timer                                   dpkg-db-backup.service
-Wed [PRIVATE_IP] 00:05:59 MSK 2h 48min Tue [PRIVATE_IP] 00:02:16 MSK       21h ago homelab-docker-health.timer                            homelab-docker-health.service
-Wed [PRIVATE_IP] 00:08:51 MSK 2h 51min Tue [PRIVATE_IP] 00:18:04 MSK       20h ago homelab-storage-capacity.timer                         homelab-storage-capacity.service
-Wed [PRIVATE_IP] 00:11:26 MSK 2h 54min Tue [PRIVATE_IP] 00:09:07 MSK       21h ago homelab-evidence-catalog.timer                         homelab-evidence-catalog.service
-Wed [PRIVATE_IP] 00:14:14 MSK 2h 57min Tue [PRIVATE_IP] 00:05:16 MSK       21h ago homelab-quality-gate.timer                             homelab-quality-gate.service
-Wed [PRIVATE_IP] 00:17:02 MSK 2h 59min Tue [PRIVATE_IP] 18:10:32 MSK   3h 6min ago homelab-mailru-trash-gc.timer                          homelab-mailru-trash-gc.service
-Wed [PRIVATE_IP] 00:34:16 MSK 3h 17min Tue [PRIVATE_IP] 20:31:32 MSK     45min ago homelab-vm-cloud-quorum-queue.timer                    homelab-vm-cloud-quorum-queue.service
-Wed [PRIVATE_IP] 00:41:05 MSK 3h 24min Tue [PRIVATE_IP] 00:58:58 MSK       20h ago logrotate.timer                                        logrotate.service
-Wed [PRIVATE_IP] 03:34:03 MSK       6h Tue [PRIVATE_IP] 03:20:54 MSK       17h ago homelab-backup-retention-gc.timer                      homelab-backup-retention-gc.service
-Wed [PRIVATE_IP] 05:22:57 MSK       8h Tue [PRIVATE_IP] 04:55:16 MSK       16h ago pve-daily-update.timer                                 pve-daily-update.service
-Wed [PRIVATE_IP] 06:54:20 MSK       9h Tue [PRIVATE_IP] 06:12:48 MSK       15h ago apt-daily-upgrade.timer                                apt-daily-upgrade.service
-Wed [PRIVATE_IP] 07:04:43 MSK       9h Tue [PRIVATE_IP] 07:07:32 MSK       14h ago homelab-drift-check.timer                              homelab-drift-check.service
-Wed [PRIVATE_IP] 07:35:36 MSK      10h Tue [PRIVATE_IP] 07:37:02 MSK       13h ago homelab-service-registry-check.timer                   homelab-service-registry-check.service
-Wed [PRIVATE_IP] 07:48:00 MSK      10h Tue [PRIVATE_IP] 07:48:52 MSK       13h ago homelab-runbook-generate.timer                         homelab-runbook-generate.service
-Wed [PRIVATE_IP] 07:51:31 MSK      10h Tue [PRIVATE_IP] 07:52:12 MSK       13h ago homelab-alerting-health.timer                          homelab-alerting-health.service
-Wed [PRIVATE_IP] 07:52:23 MSK      10h Tue [PRIVATE_IP] 07:56:52 MSK       13h ago homelab-dependency-map-check.timer                     homelab-dependency-map-check.service
-Wed [PRIVATE_IP] 07:54:12 MSK      10h Tue [PRIVATE_IP] 01:45:32 MSK       19h ago man-db.timer                                           man-db.service
-Wed [PRIVATE_IP] 07:55:12 MSK      10h Tue [PRIVATE_IP] 08:04:16 MSK       13h ago homelab-desired-state-sync.timer                       homelab-desired-state-sync.service
-Wed [PRIVATE_IP] 08:05:34 MSK      10h Tue [PRIVATE_IP] 08:04:32 MSK       13h ago homelab-duty-admin-report.timer                        homelab-duty-admin-report.service
-Wed [PRIVATE_IP] 08:12:06 MSK      10h Tue [PRIVATE_IP] 08:21:07 MSK       12h ago homelab-kuma-monitor-policy.timer                      homelab-kuma-monitor-policy.service
-Wed [PRIVATE_IP] 08:14:23 MSK      10h Tue [PRIVATE_IP] 08:10:54 MSK       13h ago homelab-overall-health.timer                           homelab-overall-health.service
-Wed [PRIVATE_IP] 08:24:06 MSK      11h Tue [PRIVATE_IP] 08:21:07 MSK       12h ago homelab-final-readiness-gate.timer                     homelab-final-readiness-gate.service
-Wed [PRIVATE_IP] 08:27:39 MSK      11h Tue [PRIVATE_IP] 08:34:32 MSK       12h ago homelab-capacity-risk.timer                            homelab-capacity-risk.service
-Wed [PRIVATE_IP] 08:40:33 MSK      11h Tue [PRIVATE_IP] 08:46:52 MSK       12h ago homelab-secret-exposure-guard.timer                    homelab-secret-exposure-guard.service
-Wed [PRIVATE_IP] 08:46:09 MSK      11h Tue [PRIVATE_IP] 08:47:54 MSK       12h ago homelab-cluster-passport.timer                         homelab-cluster-passport.service
-Wed [PRIVATE_IP] 08:55:08 MSK      11h Tue [PRIVATE_IP] 08:46:37 MSK       12h ago homelab-golden-state-index.timer                       homelab-golden-state-index.service
-Wed [PRIVATE_IP] 10:15:00 MSK      12h Tue [PRIVATE_IP] 10:15:07 MSK       11h ago skladchik-reports-monitor-monthly-selftest-watch.timer skladchik-reports-monitor-monthly-selftest-watch.service
-Wed [PRIVATE_IP] 15:18:28 MSK      18h Tue [PRIVATE_IP] 19:13:19 MSK   2h 3min ago apt-daily.timer                                        apt-daily.service
-Wed [PRIVATE_IP] 16:47:32 MSK      19h Tue [PRIVATE_IP] 16:47:32 MSK  4h 29min ago systemd-tmpfiles-clean.timer                           systemd-tmpfiles-clean.service
-Sun [PRIVATE_IP] 03:10:21 MSK   4 days Sun [PRIVATE_IP] 03:11:16 MSK    2 days ago e2scrub_all.timer                                      e2scrub_all.service
-Sun [PRIVATE_IP] 03:10:35 MSK   4 days Sun [PRIVATE_IP] 03:10:50 MSK    2 days ago xfs_scrub_all.timer                                    xfs_scrub_all.service
-Sun [PRIVATE_IP] 07:35:54 MSK   4 days Sun [PRIVATE_IP] 07:57:53 MSK    2 days ago homelab-rotating-boot-drill.timer                      homelab-rotating-boot-drill.service
-Mon [PRIVATE_IP] 00:10:37 MSK   5 days Mon [PRIVATE_IP] 00:08:52 MSK 1 day 21h ago homelab-secret-sanity.timer                            homelab-secret-sanity.service
-Mon [PRIVATE_IP] 00:30:41 MSK   5 days Mon [PRIVATE_IP] 00:39:53 MSK 1 day 20h ago fstrim.timer                                           fstrim.service
--                                  - -                                       - prometheus-node-exporter-ipmitool-sensor.timer         prometheus-node-exporter-ipmitool-sensor.service
--                                  - -                                       - prometheus-node-exporter-mellanox-hca-temp.timer       prometheus-node-exporter-mellanox-hca-temp.service
--                                  - -                                       - prometheus-node-exporter-smartmon.timer                prometheus-node-exporter-smartmon.service
-
-58 timers listed.
-RUNTIME_MANIFEST_ID=df[PRIVATE_IP]ac9b5abd[PRIVATE_IP]b[PRIVATE_IP]d89496fb2bde[PRIVATE_IP]
-EXPERIMENT_ID=5462ee[PRIVATE_IP]ebe[PRIVATE_IP]feb2ad[PRIVATE_IP]1ad87bbac0b8108
-COLLECTION_START_AT=[PRIVATE_IP]T[PRIVATE_IP]:00
-FIRST_COMPLETE_D1_CLOSE=[PRIVATE_IP]T[PRIVATE_IP]:00
-PRODUCTION_LAUNCH_ALLOWED=False
-EXECUTION_AUTHORITY=False
-RISK_AUTHORITY=False
-STAGE_A_HEALTH=AWAITING_PRIMARY_FINALITY
-FORENSIC_PREVIOUS_EPOCH_PRESERVED=YES
-
-## NEWFI_TASK6_AUTH_CHECKPOINT_V[PRIVATE_IP]
-- Scope: historical accepted AUTH test, not a current SMTP connection test.
-- Newfi approved SMTP account/sender: aleisaev@yandex.ru.
-- Endpoint used by accepted test: smtp.yandex.ru:465 with certificate verification; single PLAIN initial response accepted with code 235.
-- Evidence: incident ledger ### NEWFI_TASK6_YANDEX_AUTH_V2_OBSERVATION and ### NEWFI_TASK6_AUTH_PROOF_CLOSE_V1.
-- No password file written, no application configuration changed, no mail sent by the accepted AUTH test.
-- Persistent transport installation and application delivery are not proven by this checkpoint. Task6 is not complete.
-- AUTH challenge and missing-file incidents closed; launch/session incident remains OPEN with original cause unproven.
-- This update does not change VM211, VM160, routing, board state or Git.
-- Other incidents and infrastructure health were not assessed.
-
-
-## NEWFI_PRIVATE_STRUCTURE92_WRONG_MARKER_SCOPE_[PRIVATE_IP] CLOSURE
-- Status: CLOSED
-- RCA: NEWFI92 inspected the pve01 NEWFI90 attempt marker, which had not been finalized because the outer shell exited immediately after the guest returned RC3 following its successful rollback. The guest marker contained the true final rollback state.
-- Correction: NEWFI93 required both the guest FINISHED/ROLLED_BACK record and a fresh exact demo-state readback before reconciling the outer NEWFI90 marker. NEWFI92 itself never reserved an attempt or mutated state.
-
-
-## NEWFI_PRIVATE_NEWFI95_NESTED_TRIPLE_QUOTE_PARSE_[PRIVATE_IP]
-- Status: OPEN
-- Command: NEWFI95
-- Symptom: after the content-structure precheck passed, the pve03 Python wrapper failed to parse at the PHP line beginning with $root. No Portal discovery or application mutation was reached.
-- RCA: an outer raw triple-single-quoted guest Python payload contained an inner raw triple-single-quoted PHP payload. The inner delimiter terminated the outer Python string, causing PHP source to be parsed as Python.
-- Safety: NEWFI95 was read-only, created no attempt marker, and did not reach the intended nested guest execution. Do not replay NEWFI95.
-
-
-## NEWFI_PRIVATE_NEWFI95_NESTED_TRIPLE_QUOTE_PARSE_[PRIVATE_IP] CLOSURE
-- Status: CLOSED
-- RCA: an inner triple-single-quoted PHP literal terminated the outer triple-single-quoted Python guest payload in NEWFI95. The wrapper therefore failed parsing before the intended Portal discovery executed.
-- Correction: NEWFI96 removed the nested Python payload layer entirely and passed one Python program directly to VM211 through qm guest exec stdin. The read-only Portal contract completed with QGA exit 0 and the implementation worktree remained unchanged.
 OUTPUT_END
 CHAT_OUTPUT_END